Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14/06/2022, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd.exe
Resource
win10v2004-20220414-en
General
-
Target
2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd.exe
-
Size
337KB
-
MD5
b39b15e19c999636338d3e131e321a45
-
SHA1
01b9fe987e2a06f3db812fce719ab1d24cfa354e
-
SHA256
2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd
-
SHA512
2f4915deb55156322a32d5c80e4b34fa112fd31e1895eca51cf170951dcafcc3c99ceac05fbfab693c9e60582759d677b6ae31d4c52715bfb41638abe1b3ed72
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2324 start.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2324 start.exe 2324 start.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 start.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2324 2272 2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd.exe 77 PID 2272 wrote to memory of 2324 2272 2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd.exe 77 PID 2272 wrote to memory of 2324 2272 2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd.exe"C:\Users\Admin\AppData\Local\Temp\2c49a7c58ebe5473d28a57ce46ba6e7d915405bfbcaf9f61282193f25f2432fd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2324
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD52b736720e2c2674b8037a03266574048
SHA1b0fccf6893442467f1c8a7f05783d1f1ea27fa74
SHA25627d22e2fb09e101ec13d9dc16bf743d6a49111c3205ea9127d1733696c3afbe1
SHA51270c6458db107dc7254abc61508f014fe40f11a733d043cc1388113ef2887dcb666656d65a51d61fa65fff25ede393e4a99bf6a9976a895255f5807e57abfad94
-
Filesize
41KB
MD52b736720e2c2674b8037a03266574048
SHA1b0fccf6893442467f1c8a7f05783d1f1ea27fa74
SHA25627d22e2fb09e101ec13d9dc16bf743d6a49111c3205ea9127d1733696c3afbe1
SHA51270c6458db107dc7254abc61508f014fe40f11a733d043cc1388113ef2887dcb666656d65a51d61fa65fff25ede393e4a99bf6a9976a895255f5807e57abfad94