Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

PO 450400- 13720.exe

windows7_x64

9

PO 450400- 13720.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    45s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21/05/2022, 11:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO 450400- 13720.exe

  • Size

    1.8MB

  • MD5

    5a6d7f9876c36b2270fe5e99b096f1a4

  • SHA1

    2f458c4ed1d1edf2697bf7be60dc71a8ced883e9

  • SHA256

    e0cea593cef95fc3438ec707ef6d293c3189c3a3144a389f790cccfaec770759

  • SHA512

    a683f3ba4d84d129ffc71a8a6b7136328d15c859a943b57ecec9ce21aff998f68475b5c020bdedc82c488b57861345e703f0bb4ce6bde5cf23de805716ae610d

Score
9/10
rezer0

Malware Config

Signatures

  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO 450400- 13720.exe
    "C:\Users\Admin\AppData\Local\Temp\PO 450400- 13720.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:824
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pIvyriTVKqho" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDB52.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:672
    • C:\Users\Admin\AppData\Local\Temp\PO 450400- 13720.exe
      "{path}"
      2⤵
        PID:940
      • C:\Users\Admin\AppData\Local\Temp\PO 450400- 13720.exe
        "{path}"
        2⤵
          PID:1608
        • C:\Users\Admin\AppData\Local\Temp\PO 450400- 13720.exe
          "{path}"
          2⤵
            PID:528
          • C:\Users\Admin\AppData\Local\Temp\PO 450400- 13720.exe
            "{path}"
            2⤵
              PID:1604
            • C:\Users\Admin\AppData\Local\Temp\PO 450400- 13720.exe
              "{path}"
              2⤵
                PID:1628

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpDB52.tmp
              Filesize

              1KB

              MD5

              827edf20876b31c277b996a27c678683

              SHA1

              b4c89b7c532792f80bb257e39cb0d2d0743a43ce

              SHA256

              b6d8fcb5c0bb7485d1bffc7af76169612743a1fa07287ebfdf7ea7ef61253cb6

              SHA512

              4e6d96d6ad7947b9f3f2fff6aaee9802702af4c7f101248441479678a9ac2dbd61db474f221de676ab365f086911e6cc1e144760a6fd5391f51f5eac40348bc7

              Download Submit

            • memory/824-54-0x0000000000370000-0x000000000054C000-memory.dmp

              Filesize

              1.9MB

              Download

            • memory/824-55-0x0000000008030000-0x00000000081C6000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/824-56-0x0000000000340000-0x0000000000348000-memory.dmp

              Filesize

              32KB

              Download

            • memory/824-57-0x0000000005DE0000-0x0000000005F46000-memory.dmp

              Filesize

              1.4MB

              Download