Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
189s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02/05/2022, 17:58
Static task
static1
Behavioral task
behavioral1
Sample
06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe
Resource
win10v2004-20220414-en
General
-
Target
06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe
-
Size
14.3MB
-
MD5
5e97343f1cbbe72316b2fe4c1113be27
-
SHA1
1d6a1a4e9b23e8242bbd02809e1fe1765d6465cc
-
SHA256
06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028
-
SHA512
64f01e60f036da50edd7eabd3e0b6a6f2eca2e9cb5d34037edfb140d529b2b10ab43d7a057871cf6106475fd2c8650ad10c83e0ef0a8e3cc611f6ed2f953ede1
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
resource yara_rule behavioral2/memory/2660-154-0x0000000012920000-0x0000000012B74000-memory.dmp loaderbot -
Executes dropped EXE 5 IoCs
pid Process 3244 ExtrimHack [free][19.08.2020].exe 3956 Ex.exe 1888 csrss.com 4748 csrss.com 5056 Driver.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Ex.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sys.url csrss.com File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url RegAsm.exe -
Loads dropped DLL 1 IoCs
pid Process 4612 06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\RegAsm.exe" RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4748 set thread context of 2660 4748 csrss.com 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 2 IoCs
pid Process 1816 PING.EXE 4996 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe 2660 RegAsm.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2660 RegAsm.exe Token: SeLockMemoryPrivilege 5056 Driver.exe Token: SeLockMemoryPrivilege 5056 Driver.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1888 csrss.com 1888 csrss.com 1888 csrss.com 4748 csrss.com 4748 csrss.com 4748 csrss.com -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1888 csrss.com 1888 csrss.com 1888 csrss.com 4748 csrss.com 4748 csrss.com 4748 csrss.com -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 3244 4612 06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe 80 PID 4612 wrote to memory of 3244 4612 06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe 80 PID 4612 wrote to memory of 3244 4612 06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe 80 PID 4612 wrote to memory of 3956 4612 06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe 81 PID 4612 wrote to memory of 3956 4612 06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe 81 PID 4612 wrote to memory of 3956 4612 06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe 81 PID 3956 wrote to memory of 2708 3956 Ex.exe 85 PID 3956 wrote to memory of 2708 3956 Ex.exe 85 PID 3956 wrote to memory of 2708 3956 Ex.exe 85 PID 3956 wrote to memory of 212 3956 Ex.exe 87 PID 3956 wrote to memory of 212 3956 Ex.exe 87 PID 3956 wrote to memory of 212 3956 Ex.exe 87 PID 212 wrote to memory of 420 212 cmd.exe 89 PID 212 wrote to memory of 420 212 cmd.exe 89 PID 212 wrote to memory of 420 212 cmd.exe 89 PID 420 wrote to memory of 1816 420 cmd.exe 90 PID 420 wrote to memory of 1816 420 cmd.exe 90 PID 420 wrote to memory of 1816 420 cmd.exe 90 PID 420 wrote to memory of 2060 420 cmd.exe 91 PID 420 wrote to memory of 2060 420 cmd.exe 91 PID 420 wrote to memory of 2060 420 cmd.exe 91 PID 420 wrote to memory of 1888 420 cmd.exe 92 PID 420 wrote to memory of 1888 420 cmd.exe 92 PID 420 wrote to memory of 1888 420 cmd.exe 92 PID 420 wrote to memory of 4996 420 cmd.exe 93 PID 420 wrote to memory of 4996 420 cmd.exe 93 PID 420 wrote to memory of 4996 420 cmd.exe 93 PID 1888 wrote to memory of 4748 1888 csrss.com 94 PID 1888 wrote to memory of 4748 1888 csrss.com 94 PID 1888 wrote to memory of 4748 1888 csrss.com 94 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96 PID 4748 wrote to memory of 2660 4748 csrss.com 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe"C:\Users\Admin\AppData\Local\Temp\06abba83e0a6867c724d290a83a8fb884447822a9dc10eed02243a9141e38028.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Roaming\1337\ExtrimHack [free][19.08.2020].exe"C:\Users\Admin\AppData\Roaming\1337\ExtrimHack [free][19.08.2020].exe"2⤵
- Executes dropped EXE
PID:3244
-
-
C:\Users\Admin\AppData\Roaming\1337\Ex.exe"C:\Users\Admin\AppData\Roaming\1337\Ex.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo pUVyOKPt3⤵PID:2708
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Users\Admin\AppData\Roaming\Sysfiles & cmd < XuGJAWtEjFqgoZUl.com3⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\PING.EXEping -n 1 moLu.nnnbID5⤵
- Runs ping.exe
PID:1816
-
-
C:\Windows\SysWOW64\certutil.execertutil -decode qTh.com y5⤵PID:2060
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\csrss.comcsrss.com y5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\csrss.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\csrss.com y6⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe7⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660 -
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQqTgX5TEtWmQ8ZmVZ7 -p x -k -v=0 --donate-level=1 -t 18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 305⤵
- Runs ping.exe
PID:4996
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
921KB
MD5c317736793ef5129f12a3568cd679422
SHA1e68b55969c5f2159c847a629fac3731c0c315d53
SHA256cbb5d906c63cbcb891b35e53156b643ac26c5dec922f43b2fd121ccca60beb62
SHA51269cb5fd5f1a30c3c786ca945b8de6a460d03605fc3416a3c33e69691603e1a43ad0cfefe9cd5d6af1a154b701ecf34526cc05d9235a4e38acf994eb0edb1a82c
-
Filesize
398B
MD50047726ce0f38e02fda2068d7ff7ceff
SHA10702fd3e290b95b70b5fc3b70cdb57c808baceb7
SHA2560423e080422306752ccf52e4639a8f6e58596176e730d10bd812012ccf4f296b
SHA51200b525c341b3297e3b011065b32bab9d29eee920e7faebea93e4fcc4fef69b166c11c10291cc9ba9b931551eca3dc9ddae27b681c4d4423478ea3a65d29c7d83
-
Filesize
2.3MB
MD509cc8b02108c2ca6db6197e37b165a65
SHA19f245c5206ce171cfc288ed8bf05896d1b36a1f0
SHA25689ad1822d2ee2d5e39d2e4aae2016562244f7ea43071c192e8989a3c2544d998
SHA512d50c20b554dd85996f8b7432fb3d3668c3fbfcd77314a4adc476861373a0350b122be61ab1aa087153e45c48cf6a453d0829ccfa4786cf679ee3dccb7cffadae
-
Filesize
921KB
MD58ed172328f643375ac09b31ffba0eb63
SHA1c6716e5e5a311f597e37c5660b0387ab8f77b2a0
SHA25623e87924005aeef08ab3c9402aa749c0373ed9fa6c1706c13ca1df5ec33f8928
SHA51279efbac3cbf2bbbf1b5572a3036845fd544210a01adf9850d22587df12fd84832e14e8f7e0476955a8d9bb42ff0be5ca4443cee8e83dc396e70d850e31c60938
-
Filesize
921KB
MD58ed172328f643375ac09b31ffba0eb63
SHA1c6716e5e5a311f597e37c5660b0387ab8f77b2a0
SHA25623e87924005aeef08ab3c9402aa749c0373ed9fa6c1706c13ca1df5ec33f8928
SHA51279efbac3cbf2bbbf1b5572a3036845fd544210a01adf9850d22587df12fd84832e14e8f7e0476955a8d9bb42ff0be5ca4443cee8e83dc396e70d850e31c60938
-
Filesize
921KB
MD58ed172328f643375ac09b31ffba0eb63
SHA1c6716e5e5a311f597e37c5660b0387ab8f77b2a0
SHA25623e87924005aeef08ab3c9402aa749c0373ed9fa6c1706c13ca1df5ec33f8928
SHA51279efbac3cbf2bbbf1b5572a3036845fd544210a01adf9850d22587df12fd84832e14e8f7e0476955a8d9bb42ff0be5ca4443cee8e83dc396e70d850e31c60938
-
Filesize
1.1MB
MD513a508782d30a527e997a64996920287
SHA14628a103700d13b6f3920b3a8a06e9757bf0a9eb
SHA256e06ad6278f8cdccb51ed58aee3d6ba97bd770b2d8b827746e539770fc959354e
SHA512cd860c7c8eea0faf0e62f1e695f60c02050c284617265f3e9c11dac4e4cbea34cb656719ae6bdeb39a36dd1446bb443cbcf9c9f4a595c1749f9088d7c082d142
-
Filesize
842KB
MD5dbcc4336d132df084c59bbddff9693f5
SHA1172d404379f6d288db4eacaa11bf0fa1ccffa451
SHA256ea3b51ae7fb4264cd4aca28f02fa027bb25ce69a9ece5ff1f9f581b1ae62c84e
SHA512d7209e47c9ef7e8f0db4bc736828e79d745415dde0dbaa7b4d5a21d6ee3406b139f3565cdcae16911c330d3ebbe1bcbe77f5e40d2313909a3b7b58697d3d4e34
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
3.1MB
MD57afcb8667f1ec33f0cc084936a8a4044
SHA1a2755123f3515fbfcbd5b1ab38c22fa757b8afa8
SHA2562304cf3b3d0753318d60c2769c535a164d5f56ee0343c59ac616036d95e8ad71
SHA512bc04b81c01df03b360c225709d2db3078d1fb45fc2a67713f5f5154d050c71e241c2c7590f510d9f7ac3a0a4bc820b3b171d96cb56d23c0496df184e527162b8
-
Filesize
3.1MB
MD57afcb8667f1ec33f0cc084936a8a4044
SHA1a2755123f3515fbfcbd5b1ab38c22fa757b8afa8
SHA2562304cf3b3d0753318d60c2769c535a164d5f56ee0343c59ac616036d95e8ad71
SHA512bc04b81c01df03b360c225709d2db3078d1fb45fc2a67713f5f5154d050c71e241c2c7590f510d9f7ac3a0a4bc820b3b171d96cb56d23c0496df184e527162b8
-
Filesize
11.3MB
MD50d41a5f1d9f4b47dbdc7ed36e93e29be
SHA1fa632b0f304a8df63cb097917cdf88a29a0b0697
SHA256ebb12a3ba49cb301b5f3670ca0387fac092256c4fd02f3d71065f91ffa0393ad
SHA512382d9d7fe2b5a3b2e61d5f3dc689ce53416796b405af7d774136ed537909ba01d2d2a32b0156456d638d97f439a250fecb499feedea15380b7f59e9d0ff0078a
-
Filesize
11.3MB
MD50d41a5f1d9f4b47dbdc7ed36e93e29be
SHA1fa632b0f304a8df63cb097917cdf88a29a0b0697
SHA256ebb12a3ba49cb301b5f3670ca0387fac092256c4fd02f3d71065f91ffa0393ad
SHA512382d9d7fe2b5a3b2e61d5f3dc689ce53416796b405af7d774136ed537909ba01d2d2a32b0156456d638d97f439a250fecb499feedea15380b7f59e9d0ff0078a
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322