Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03/06/2022, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
f3b2c0e21faa2d771b315cfda97a4c32.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
f3b2c0e21faa2d771b315cfda97a4c32.exe
-
Size
2.5MB
-
MD5
f3b2c0e21faa2d771b315cfda97a4c32
-
SHA1
806b920c7c0299ffa9fbe4c94825d0313381927f
-
SHA256
3f0841eff18ab98e2614071d89619c1fb84e653cb1c524384801bdf00d7e9d42
-
SHA512
6c0503c9523027ebc2c4363e2d3aef39c513316aaf69bdf5f660112a1f3f1371ca20d5f8f134485ee573076084592ace1bc5e1056c8d645e010bb6b2267b19b2
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation f3b2c0e21faa2d771b315cfda97a4c32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe Token: SeIncBasePriorityPrivilege 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe Token: 33 1724 f3b2c0e21faa2d771b315cfda97a4c32.exe Token: SeIncBasePriorityPrivilege 1724 f3b2c0e21faa2d771b315cfda97a4c32.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1788 wrote to memory of 3276 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 85 PID 1788 wrote to memory of 3276 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 85 PID 1788 wrote to memory of 3276 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 85 PID 1788 wrote to memory of 3840 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 86 PID 1788 wrote to memory of 3840 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 86 PID 1788 wrote to memory of 3840 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 86 PID 1788 wrote to memory of 3224 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 87 PID 1788 wrote to memory of 3224 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 87 PID 1788 wrote to memory of 3224 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 87 PID 1788 wrote to memory of 2060 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 88 PID 1788 wrote to memory of 2060 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 88 PID 1788 wrote to memory of 2060 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 88 PID 1788 wrote to memory of 4772 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 89 PID 1788 wrote to memory of 4772 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 89 PID 1788 wrote to memory of 4772 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 89 PID 1788 wrote to memory of 4288 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 90 PID 1788 wrote to memory of 4288 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 90 PID 1788 wrote to memory of 4288 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 90 PID 1788 wrote to memory of 3684 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 91 PID 1788 wrote to memory of 3684 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 91 PID 1788 wrote to memory of 3684 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 91 PID 1788 wrote to memory of 3628 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 92 PID 1788 wrote to memory of 3628 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 92 PID 1788 wrote to memory of 3628 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 92 PID 1788 wrote to memory of 820 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 93 PID 1788 wrote to memory of 820 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 93 PID 1788 wrote to memory of 820 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 93 PID 1788 wrote to memory of 536 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 94 PID 1788 wrote to memory of 536 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 94 PID 1788 wrote to memory of 536 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 94 PID 1788 wrote to memory of 1676 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 95 PID 1788 wrote to memory of 1676 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 95 PID 1788 wrote to memory of 1676 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 95 PID 1788 wrote to memory of 1724 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 96 PID 1788 wrote to memory of 1724 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 96 PID 1788 wrote to memory of 1724 1788 f3b2c0e21faa2d771b315cfda97a4c32.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:3276
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:3224
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:2060
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:4772
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:4288
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:3684
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:3628
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:820
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:536
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724
-