Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

4c941ca70a...15.exe

windows7-x64

8

4c941ca70a...15.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 21:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe

  • Size

    35KB

  • MD5

    f94a517ed28a7ffc4012caba54e76271

  • SHA1

    43865e57d84c4624b66c40c62171860e6665ab2c

  • SHA256

    4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15

  • SHA512

    f1b563d4489b9f0101ba421a39bd378bf85b94865418afbd485ac95bdbebfc147d65a1208f9377d25d866a3e480c1d8e97ad07c5bef458e73cce5a80dd8a41b6

  • SSDEEP

    768:cflivXrVKpVhKvtxwYHwVFoeAQumucwU/C:ylqrVKprVuQuoC

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe
    "C:\Users\Admin\AppData\Local\Temp\4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Program Files (x86)\5bbfe48e\jusched.exe
      "C:\Program Files (x86)\5bbfe48e\jusched.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:340

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\5bbfe48e\5bbfe48e
    Filesize

    13B

    MD5

    f253efe302d32ab264a76e0ce65be769

    SHA1

    768685ca582abd0af2fbb57ca37752aa98c9372b

    SHA256

    49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

    SHA512

    1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

    Download Submit

  • C:\Program Files (x86)\5bbfe48e\jusched.exe
    Filesize

    35KB

    MD5

    bbbcc0d7c48a5fd70c5285f43f4a33ff

    SHA1

    6205188d60ec3f2168b7dbadeac9b0e08be651af

    SHA256

    074d5450ca39891bc8c2db1be845a4951c58c08c044c623fce6f277bb2283c11

    SHA512

    0dad3959fb325197ee3b9ad964473965687da9890a359ae7cd5b927a7fa9dedc29f7cfce26602d024f385cd3c2fdb7aaba3e954b9abe7de7dbf5431d4fd42e60

    Download Submit

  • C:\Program Files (x86)\5bbfe48e\jusched.exe
    Filesize

    35KB

    MD5

    bbbcc0d7c48a5fd70c5285f43f4a33ff

    SHA1

    6205188d60ec3f2168b7dbadeac9b0e08be651af

    SHA256

    074d5450ca39891bc8c2db1be845a4951c58c08c044c623fce6f277bb2283c11

    SHA512

    0dad3959fb325197ee3b9ad964473965687da9890a359ae7cd5b927a7fa9dedc29f7cfce26602d024f385cd3c2fdb7aaba3e954b9abe7de7dbf5431d4fd42e60

    Download Submit