Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe
Resource
win10v2004-20220812-en
General
-
Target
5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe
-
Size
93KB
-
MD5
574262c2484256d298bb1395fc39de2b
-
SHA1
2472edb4ab746087f7480c440256d5b1cbfa0cb7
-
SHA256
5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452
-
SHA512
94e2fa929610830586d2d016b46595baee01ea37497a10220c0cfbf72d7ee42c1e89d84f17a4ae825c0330a41cf7d12862b90e1ccb801620998438de19cf1960
-
SSDEEP
1536:ze5iRWD7X7c0h4VJtkvmIY7u2Bx8plVL3YIgyyLYvuWQNcpfyKn+hP:zejD77cs4VjomzBx8pld/n7YI+P
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3748 backup.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4804 wrote to memory of 3748 4804 5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe 82 PID 4804 wrote to memory of 3748 4804 5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe 82 PID 4804 wrote to memory of 3748 4804 5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe"C:\Users\Admin\AppData\Local\Temp\5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\backup.exe"C:\backup.exe"2⤵
- Executes dropped EXE
PID:3748
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5f90fa1ab4cf6048339fee351d57b9474
SHA16f2973bd8d6f43f9c08a407e64ddeec4f7570f1c
SHA25691f803c1eb18df1521e75a06ca15dcd781d4dd537f7d19b6cca8641cfcfe9129
SHA512572785d734bd86c4b61f75f5985ca4cb027ce79d3327703daf0c9ca19bff2c77c77d2cbd49cb6cf2a7fdb2cfdff077957100f0e3744dd0e81fe813dab1f40914
-
Filesize
15KB
MD5f90fa1ab4cf6048339fee351d57b9474
SHA16f2973bd8d6f43f9c08a407e64ddeec4f7570f1c
SHA25691f803c1eb18df1521e75a06ca15dcd781d4dd537f7d19b6cca8641cfcfe9129
SHA512572785d734bd86c4b61f75f5985ca4cb027ce79d3327703daf0c9ca19bff2c77c77d2cbd49cb6cf2a7fdb2cfdff077957100f0e3744dd0e81fe813dab1f40914