Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 14:55

General

  • Target

    73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe

  • Size

    52KB

  • MD5

    6473b074b73b9ca176311bf100e02d9a

  • SHA1

    19c03060ab2bedf181df7f406a31e90db8e8ac1d

  • SHA256

    73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18

  • SHA512

    dcb5a7d278169292ba0291386b72e9bccc6064d9b12f99cbf90a9d3513f7036b7863cd0e3fae8c9195cbf29ae472d3b1d4bd53608268656d31ea7dc31ee12d7c

  • SSDEEP

    768:OWEJbB6haGnJntgTVH7NHaurxmWXOQfwoObuPb77e5yC:OWE96Jnml5lXAoO+H7cyC

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe
    "C:\Users\Admin\AppData\Local\Temp\73ec0de7c9867bbf261b7ce319bb8c18fd1acaf52f4b2867f7444559ecf87d18.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Users\Admin\duedue.exe
      "C:\Users\Admin\duedue.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1588

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\duedue.exe

    Filesize

    52KB

    MD5

    e5f93aa213e70e67325295786e44971b

    SHA1

    9cea74cf8655e33cebf95adea3000d16e6ce7d1a

    SHA256

    e903e713f0f9fa3463e69ad95bf34112deea38be1abbbd260b17c26114c2a951

    SHA512

    39a53511fcdbc003ba72d623587233a9059d19936bb3aebcdb0296d5964d9e16ac86fc477d8862573c92ca056553bab9c4bb4463b7476184a71f927b0193b8fe

  • C:\Users\Admin\duedue.exe

    Filesize

    52KB

    MD5

    e5f93aa213e70e67325295786e44971b

    SHA1

    9cea74cf8655e33cebf95adea3000d16e6ce7d1a

    SHA256

    e903e713f0f9fa3463e69ad95bf34112deea38be1abbbd260b17c26114c2a951

    SHA512

    39a53511fcdbc003ba72d623587233a9059d19936bb3aebcdb0296d5964d9e16ac86fc477d8862573c92ca056553bab9c4bb4463b7476184a71f927b0193b8fe