Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24/05/2022, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe
-
Size
6.2MB
-
MD5
538113e9711446351217d1d2b93b1885
-
SHA1
6fc25abd2a7e1e15113eea2105349065681b1c27
-
SHA256
cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060
-
SHA512
c3e20b52373785549dfa269b692fa007aa0cede221e95f705b33d4a36a54e6cbfdf3c1831c11e2c3035aab7f171e152e6a14cc0913916965f8e12a789ffdf49f
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe" cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System64\\1systemsmss.exe, explorer.exe" cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe" 1systemsmss.exe -
Executes dropped EXE 5 IoCs
pid Process 2116 1systemsmss.exe 4356 svnhost.exe 2832 svnhost.exe 1176 svnhost.exe 5092 svnhost.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 1systemsmss.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run 1systemsmss.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Zont911\Home.zip 1systemsmss.exe File created C:\Windows\System64\vp8decoder.dll 1systemsmss.exe File opened for modification C:\Windows\System64\vp8decoder.dll 1systemsmss.exe File created C:\Windows\System64\vp8encoder.dll 1systemsmss.exe File opened for modification C:\Windows\System64\vp8encoder.dll 1systemsmss.exe File created C:\Windows\System64\systemsmss.exe 1systemsmss.exe File opened for modification C:\Windows\System64\systemsmss.exe 1systemsmss.exe File created C:\Windows\Zont911\Regedit.reg 1systemsmss.exe File created C:\Windows\Zont911\Tupe.bat 1systemsmss.exe File opened for modification C:\Windows\System64\1systemsmss.exe cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe File created C:\Windows\System64\svnhost.exe 1systemsmss.exe File opened for modification C:\Windows\System64\svnhost.exe 1systemsmss.exe File created C:\Windows\System64\1systemsmss.exe cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs .reg file with regedit 1 IoCs
pid Process 4400 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4356 svnhost.exe Token: SeDebugPrivilege 1176 svnhost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4356 svnhost.exe 2832 svnhost.exe 1176 svnhost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2116 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 82 PID 2648 wrote to memory of 2116 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 82 PID 2648 wrote to memory of 2116 2648 cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe 82 PID 2116 wrote to memory of 4400 2116 1systemsmss.exe 84 PID 2116 wrote to memory of 4400 2116 1systemsmss.exe 84 PID 2116 wrote to memory of 4400 2116 1systemsmss.exe 84 PID 2116 wrote to memory of 1440 2116 1systemsmss.exe 94 PID 2116 wrote to memory of 1440 2116 1systemsmss.exe 94 PID 2116 wrote to memory of 1440 2116 1systemsmss.exe 94 PID 1440 wrote to memory of 1720 1440 cmd.exe 86 PID 1440 wrote to memory of 1720 1440 cmd.exe 86 PID 1440 wrote to memory of 1720 1440 cmd.exe 86 PID 1440 wrote to memory of 4356 1440 cmd.exe 87 PID 1440 wrote to memory of 4356 1440 cmd.exe 87 PID 1440 wrote to memory of 4356 1440 cmd.exe 87 PID 1440 wrote to memory of 2832 1440 cmd.exe 88 PID 1440 wrote to memory of 2832 1440 cmd.exe 88 PID 1440 wrote to memory of 2832 1440 cmd.exe 88 PID 1440 wrote to memory of 1176 1440 cmd.exe 90 PID 1440 wrote to memory of 1176 1440 cmd.exe 90 PID 1440 wrote to memory of 1176 1440 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe"C:\Users\Admin\AppData\Local\Temp\cb2a2be7c24e35bafb85bcdb05e19c108452630f54719e2134339df59e9aa060.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\System64\1systemsmss.exe"C:\Windows\System64\1systemsmss.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"3⤵
- Runs .reg file with regedit
PID:4400
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\Zont911\Tupe.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1440
-
-
-
C:\Windows\SysWOW64\chcp.comChcp 12511⤵PID:1720
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /silentinstall1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4356
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /firewall1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2832
-
C:\Windows\System64\svnhost.exeC:\Windows\System64\svnhost.exe1⤵
- Executes dropped EXE
PID:5092 -
C:\Windows\System64\systemsmss.exeC:\Windows\System64\systemsmss.exe /tray2⤵PID:3124
-
-
C:\Windows\System64\systemsmss.exeC:\Windows\System64\systemsmss.exe2⤵PID:212
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /start1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1176