Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
09/03/2022, 20:22
Static task
static1
Behavioral task
behavioral1
Sample
686b40dcb167653cb7a8463928c26af1.exe
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
686b40dcb167653cb7a8463928c26af1.exe
-
Size
9.5MB
-
MD5
686b40dcb167653cb7a8463928c26af1
-
SHA1
d6146b6fdf516223735e4e881fa797432dff3923
-
SHA256
595e1545c53d27fb1315e70b241e66f44b28a49be59a717ca4936d167e121470
-
SHA512
c40d9c17e1b6d1100425b15d0f800562579b935a83e1c9b8f4099d8a4262b7287f545f4c0a00ab040c92e239fe946416242461dd712d4cb63deca5f651558f8f
Malware Config
Extracted
Family
systembc
C2
5.101.78.2:4127
192.53.123.202:4127
Signatures
-
Babadeda Crypter 3 IoCs
resource yara_rule behavioral1/files/0x0005000000015d32-125.dat family_babadeda behavioral1/memory/632-131-0x0000000003D70000-0x0000000007F70000-memory.dmp family_babadeda behavioral1/memory/1720-145-0x0000000001E20000-0x0000000006020000-memory.dmp family_babadeda -
Executes dropped EXE 5 IoCs
pid Process 1356 686b40dcb167653cb7a8463928c26af1.tmp 1200 686b40dcb167653cb7a8463928c26af1.tmp 2016 tracegen.exe 632 PDapp.exe 1720 PDapp.exe -
Loads dropped DLL 52 IoCs
pid Process 1548 686b40dcb167653cb7a8463928c26af1.exe 688 686b40dcb167653cb7a8463928c26af1.exe 1200 686b40dcb167653cb7a8463928c26af1.tmp 1200 686b40dcb167653cb7a8463928c26af1.tmp 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 632 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe 1720 PDapp.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\wow64.job PDapp.exe File opened for modification C:\Windows\Tasks\wow64.job PDapp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1200 686b40dcb167653cb7a8463928c26af1.tmp 1200 686b40dcb167653cb7a8463928c26af1.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1200 686b40dcb167653cb7a8463928c26af1.tmp -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1548 wrote to memory of 1356 1548 686b40dcb167653cb7a8463928c26af1.exe 27 PID 1548 wrote to memory of 1356 1548 686b40dcb167653cb7a8463928c26af1.exe 27 PID 1548 wrote to memory of 1356 1548 686b40dcb167653cb7a8463928c26af1.exe 27 PID 1548 wrote to memory of 1356 1548 686b40dcb167653cb7a8463928c26af1.exe 27 PID 1548 wrote to memory of 1356 1548 686b40dcb167653cb7a8463928c26af1.exe 27 PID 1548 wrote to memory of 1356 1548 686b40dcb167653cb7a8463928c26af1.exe 27 PID 1548 wrote to memory of 1356 1548 686b40dcb167653cb7a8463928c26af1.exe 27 PID 1356 wrote to memory of 688 1356 686b40dcb167653cb7a8463928c26af1.tmp 28 PID 1356 wrote to memory of 688 1356 686b40dcb167653cb7a8463928c26af1.tmp 28 PID 1356 wrote to memory of 688 1356 686b40dcb167653cb7a8463928c26af1.tmp 28 PID 1356 wrote to memory of 688 1356 686b40dcb167653cb7a8463928c26af1.tmp 28 PID 1356 wrote to memory of 688 1356 686b40dcb167653cb7a8463928c26af1.tmp 28 PID 1356 wrote to memory of 688 1356 686b40dcb167653cb7a8463928c26af1.tmp 28 PID 1356 wrote to memory of 688 1356 686b40dcb167653cb7a8463928c26af1.tmp 28 PID 688 wrote to memory of 1200 688 686b40dcb167653cb7a8463928c26af1.exe 29 PID 688 wrote to memory of 1200 688 686b40dcb167653cb7a8463928c26af1.exe 29 PID 688 wrote to memory of 1200 688 686b40dcb167653cb7a8463928c26af1.exe 29 PID 688 wrote to memory of 1200 688 686b40dcb167653cb7a8463928c26af1.exe 29 PID 688 wrote to memory of 1200 688 686b40dcb167653cb7a8463928c26af1.exe 29 PID 688 wrote to memory of 1200 688 686b40dcb167653cb7a8463928c26af1.exe 29 PID 688 wrote to memory of 1200 688 686b40dcb167653cb7a8463928c26af1.exe 29 PID 1200 wrote to memory of 2016 1200 686b40dcb167653cb7a8463928c26af1.tmp 30 PID 1200 wrote to memory of 2016 1200 686b40dcb167653cb7a8463928c26af1.tmp 30 PID 1200 wrote to memory of 2016 1200 686b40dcb167653cb7a8463928c26af1.tmp 30 PID 1200 wrote to memory of 2016 1200 686b40dcb167653cb7a8463928c26af1.tmp 30 PID 1200 wrote to memory of 632 1200 686b40dcb167653cb7a8463928c26af1.tmp 32 PID 1200 wrote to memory of 632 1200 686b40dcb167653cb7a8463928c26af1.tmp 32 PID 1200 wrote to memory of 632 1200 686b40dcb167653cb7a8463928c26af1.tmp 32 PID 1200 wrote to memory of 632 1200 686b40dcb167653cb7a8463928c26af1.tmp 32 PID 916 wrote to memory of 1720 916 taskeng.exe 34 PID 916 wrote to memory of 1720 916 taskeng.exe 34 PID 916 wrote to memory of 1720 916 taskeng.exe 34 PID 916 wrote to memory of 1720 916 taskeng.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\686b40dcb167653cb7a8463928c26af1.exe"C:\Users\Admin\AppData\Local\Temp\686b40dcb167653cb7a8463928c26af1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\is-3AI8R.tmp\686b40dcb167653cb7a8463928c26af1.tmp"C:\Users\Admin\AppData\Local\Temp\is-3AI8R.tmp\686b40dcb167653cb7a8463928c26af1.tmp" /SL5="$40154,9084029,780800,C:\Users\Admin\AppData\Local\Temp\686b40dcb167653cb7a8463928c26af1.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\686b40dcb167653cb7a8463928c26af1.exe"C:\Users\Admin\AppData\Local\Temp\686b40dcb167653cb7a8463928c26af1.exe" /VERYSILENT3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\is-9F9K3.tmp\686b40dcb167653cb7a8463928c26af1.tmp"C:\Users\Admin\AppData\Local\Temp\is-9F9K3.tmp\686b40dcb167653cb7a8463928c26af1.tmp" /SL5="$40108,9084029,780800,C:\Users\Admin\AppData\Local\Temp\686b40dcb167653cb7a8463928c26af1.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Roaming\Sure Cuts A Lot 5\tracegen.exe"C:\Users\Admin\AppData\Roaming\Sure Cuts A Lot 5\tracegen.exe"5⤵
- Executes dropped EXE
PID:2016
-
-
C:\Users\Admin\AppData\Roaming\Sure Cuts A Lot 5\PDapp.exe"C:\Users\Admin\AppData\Roaming\Sure Cuts A Lot 5\PDapp.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:632
-
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A4DCC971-774E-4090-9A6C-9D942512732F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Roaming\Sure Cuts A Lot 5\PDapp.exe"C:\Users\Admin\AppData\Roaming\Sure Cuts A Lot 5\PDapp.exe" start2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720
-