Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

e693ba3857...2d.exe

windows7_x64

10

e693ba3857...2d.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    79s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    19/04/2022, 03:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d.exe

  • Size

    7.4MB

  • MD5

    1cf5dd5e5b0074edcba997bb52ca95ca

  • SHA1

    aa64c566f081986367b805ce3093f188b7fa9af8

  • SHA256

    e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d

  • SHA512

    7373691c3a14fe7c4bfcbee3c9e0cf671a06ebe2ddfb011bca34e71edf2593cdd47ec08d32d0d46974da5a40ddf1d86c033574612756a308507dd9e7796c8134

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 7 IoCs
    evasion
  • Modifies data under HKEY_USERS 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d.exe
    "C:\Users\Admin\AppData\Local\Temp\e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\ProgramData\e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d.exe
      C:\ProgramData\e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM MSExchange*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1272
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM Microsoft*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3612
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM ora*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3348
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM tns*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4112
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM mysql*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2360
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM sql*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4012
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM postgres*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3184
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4968
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1700

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d.exe
    Filesize

    7.4MB

    MD5

    1cf5dd5e5b0074edcba997bb52ca95ca

    SHA1

    aa64c566f081986367b805ce3093f188b7fa9af8

    SHA256

    e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d

    SHA512

    7373691c3a14fe7c4bfcbee3c9e0cf671a06ebe2ddfb011bca34e71edf2593cdd47ec08d32d0d46974da5a40ddf1d86c033574612756a308507dd9e7796c8134

    Download Submit

  • C:\ProgramData\e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d.exe
    Filesize

    7.4MB

    MD5

    1cf5dd5e5b0074edcba997bb52ca95ca

    SHA1

    aa64c566f081986367b805ce3093f188b7fa9af8

    SHA256

    e693ba3857027dd1c9e234dcadd35e76a96b2fa9b34a618f2b4a2b3b9403cf2d

    SHA512

    7373691c3a14fe7c4bfcbee3c9e0cf671a06ebe2ddfb011bca34e71edf2593cdd47ec08d32d0d46974da5a40ddf1d86c033574612756a308507dd9e7796c8134

    Download Submit