Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 07:32

General

  • Target

    63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe

  • Size

    120KB

  • MD5

    8f3224c97f8005c4c699f9ec6726d088

  • SHA1

    2d7fa4a9ce69392e618cb1b074ef624cea3d07f4

  • SHA256

    63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26

  • SHA512

    45ad7b1c3795fa5dc161a11650053c1243624a87a8b8bf524975c05fd4923ffeaabac9224ae4def15483246dc67f754c012b7567131e56db3bb784eee2d2cf05

  • SSDEEP

    3072:swR5g46PJh1OKknKplw5FmxoQmh2mRaOTnz:ZR2zBOKknU25PP

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe
    "C:\Users\Admin\AppData\Local\Temp\63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Users\Admin\AppData\Local\Temp\¶¯Ì¬Ãܱ£.exe
      "C:\Users\Admin\AppData\Local\Temp\¶¯Ì¬Ãܱ£.exe"
      2⤵
      • Executes dropped EXE
      • Sets DLL path for service in the registry
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /t /im ZhuDongFangYu.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:4628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nssDB33.tmp\System.dll

    Filesize

    10KB

    MD5

    0c8ea8e6637bbf8408104e672d78ba45

    SHA1

    c231c7acaf9abb7da93f28e1b71bed164d57103e

    SHA256

    509a93177a7ae130bc3b6b5ec3236c7aa0811b8b86f8ab3442c65fdf8ff85b1f

    SHA512

    ee763a3cdbbba3b28e6a903ac942c7228bd8e54b19de21d6187e481f2916d833d9b9800e5ac2998f4aa26274cdfb20a8bfdd10f00f2a15d37bcc529b617e1f28

  • C:\Users\Admin\AppData\Local\Temp\¶¯Ì¬Ãܱ£.exe

    Filesize

    128KB

    MD5

    beaea5635620f8f418f2d0f7cd7214f4

    SHA1

    cfa7222030a3c878abff82149ef2f0f899638b2b

    SHA256

    43e865c58891a45fd048c33936881f5b6cccbf4da68e7889cf72ea5229d7895f

    SHA512

    7ea078a04b375f20f22216fc4475bb4ebc11c602510b5661c3e4216d5a05e2457674e2b3c7e59e5ef1b39e4fce644a1f3f09cbc945258606bb696d9eed294e7c

  • C:\Users\Admin\AppData\Local\Temp\¶¯Ì¬Ãܱ£.exe

    Filesize

    128KB

    MD5

    beaea5635620f8f418f2d0f7cd7214f4

    SHA1

    cfa7222030a3c878abff82149ef2f0f899638b2b

    SHA256

    43e865c58891a45fd048c33936881f5b6cccbf4da68e7889cf72ea5229d7895f

    SHA512

    7ea078a04b375f20f22216fc4475bb4ebc11c602510b5661c3e4216d5a05e2457674e2b3c7e59e5ef1b39e4fce644a1f3f09cbc945258606bb696d9eed294e7c

  • C:\Users\Local Server\wanmei.dll

    Filesize

    105KB

    MD5

    67e11a234e9f1c96fd81f1695c5303c2

    SHA1

    c74ccbc2f80dcfe004bab8a8a98a4826ce0fdb15

    SHA256

    be4d73c747e922f5357808f87968a4565947def73313ea12347ed21b1fd71413

    SHA512

    c837fb849cd809225fa448309fd656cec66bb0b52d17eda3ead8a5b1d3062d7cbcc45f7a6a7482f5d28bef55bfb17e99e7dffc0c676c84bdfa4054238f816b9f

  • \??\c:\documents and settings\local server\wanmei.dll

    Filesize

    105KB

    MD5

    67e11a234e9f1c96fd81f1695c5303c2

    SHA1

    c74ccbc2f80dcfe004bab8a8a98a4826ce0fdb15

    SHA256

    be4d73c747e922f5357808f87968a4565947def73313ea12347ed21b1fd71413

    SHA512

    c837fb849cd809225fa448309fd656cec66bb0b52d17eda3ead8a5b1d3062d7cbcc45f7a6a7482f5d28bef55bfb17e99e7dffc0c676c84bdfa4054238f816b9f

  • memory/4628-139-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/4628-140-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB