Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 19:31

General

  • Target

    77ed04861699a6d4b331d48339cac5c217c597a549e5cb40b7d0af45e4c549a5.exe

  • Size

    277KB

  • MD5

    9029e0ea85ca6a8dbcf395647858ae5e

  • SHA1

    8c212f137d78ee314d28df0551bc64e99757bf64

  • SHA256

    77ed04861699a6d4b331d48339cac5c217c597a549e5cb40b7d0af45e4c549a5

  • SHA512

    2915a9dc9a88b01caf54de47e7a9d07c59583aae7266a782c983f9a78f202c522339a17dc2e0f7328bca167a12e4aabd1f3a763a5ea1a753695e857c85db5ddd

  • SSDEEP

    6144:g+1QlJF9EW9B1zucjpfwEzeAWc/r9AwGNkVsuaRaU6mHGU:gUMwseGpi0aRz6mHGU

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77ed04861699a6d4b331d48339cac5c217c597a549e5cb40b7d0af45e4c549a5.exe
    "C:\Users\Admin\AppData\Local\Temp\77ed04861699a6d4b331d48339cac5c217c597a549e5cb40b7d0af45e4c549a5.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Windows\system\services.exe
      "C:\Windows\system\services.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Users\Admin\AppData\Local\Temp\77ed04861699a6d4b331d48339cac5c217c597a549e5cb40b7d0af45e4c549a5.exe
        "C:\Users\Admin\AppData\Local\Temp\77ed04861699a6d4b331d48339cac5c217c597a549e5cb40b7d0af45e4c549a5.exe"
        3⤵
        • Checks computer location settings
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3336
        • C:\Windows\system\services.exe
          "C:\Windows\system\services.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:224

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    06a9cdfe44e4c18590ee9c7f61222516

    SHA1

    46a86da27b781b039e6a434f990a899d1e7022ac

    SHA256

    f58787f71f00910d40f58ff1ed9b9e627bc52e074261f628b996d4cc69ec144c

    SHA512

    e3ed9735555fd6386a85245bc8bb6da49d6fd9614b91a8e7975325348d2232d7e13fceb16c500e75e92da62f017149711665ceb961a5f78f80a8c6e28f3ba6f7

  • C:\Windows\System\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    06a9cdfe44e4c18590ee9c7f61222516

    SHA1

    46a86da27b781b039e6a434f990a899d1e7022ac

    SHA256

    f58787f71f00910d40f58ff1ed9b9e627bc52e074261f628b996d4cc69ec144c

    SHA512

    e3ed9735555fd6386a85245bc8bb6da49d6fd9614b91a8e7975325348d2232d7e13fceb16c500e75e92da62f017149711665ceb961a5f78f80a8c6e28f3ba6f7

  • C:\Windows\System\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    06a9cdfe44e4c18590ee9c7f61222516

    SHA1

    46a86da27b781b039e6a434f990a899d1e7022ac

    SHA256

    f58787f71f00910d40f58ff1ed9b9e627bc52e074261f628b996d4cc69ec144c

    SHA512

    e3ed9735555fd6386a85245bc8bb6da49d6fd9614b91a8e7975325348d2232d7e13fceb16c500e75e92da62f017149711665ceb961a5f78f80a8c6e28f3ba6f7

  • C:\Windows\System\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    06a9cdfe44e4c18590ee9c7f61222516

    SHA1

    46a86da27b781b039e6a434f990a899d1e7022ac

    SHA256

    f58787f71f00910d40f58ff1ed9b9e627bc52e074261f628b996d4cc69ec144c

    SHA512

    e3ed9735555fd6386a85245bc8bb6da49d6fd9614b91a8e7975325348d2232d7e13fceb16c500e75e92da62f017149711665ceb961a5f78f80a8c6e28f3ba6f7

  • C:\Windows\System\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    06a9cdfe44e4c18590ee9c7f61222516

    SHA1

    46a86da27b781b039e6a434f990a899d1e7022ac

    SHA256

    f58787f71f00910d40f58ff1ed9b9e627bc52e074261f628b996d4cc69ec144c

    SHA512

    e3ed9735555fd6386a85245bc8bb6da49d6fd9614b91a8e7975325348d2232d7e13fceb16c500e75e92da62f017149711665ceb961a5f78f80a8c6e28f3ba6f7

  • C:\Windows\System\services.exe

    Filesize

    278KB

    MD5

    9f418a7b388c384b2ebe1dd3ee78b575

    SHA1

    c6ed2d0d6a3ca75fb3fef44dcfa08cb9a2f1ea8a

    SHA256

    e38c6474075540c09392be7dfe31ee8622daf2534139d6d9d1a08c8224db5efb

    SHA512

    3e7477e00b2efcaf0decce7653a7620df06a92f0bf201089940abbfea5f4027cc920db98e51b4ab8970b7d36b22320e1313c643f39c8e28869f41a22adae7da6

  • C:\Windows\System\services.exe

    Filesize

    278KB

    MD5

    9f418a7b388c384b2ebe1dd3ee78b575

    SHA1

    c6ed2d0d6a3ca75fb3fef44dcfa08cb9a2f1ea8a

    SHA256

    e38c6474075540c09392be7dfe31ee8622daf2534139d6d9d1a08c8224db5efb

    SHA512

    3e7477e00b2efcaf0decce7653a7620df06a92f0bf201089940abbfea5f4027cc920db98e51b4ab8970b7d36b22320e1313c643f39c8e28869f41a22adae7da6

  • C:\Windows\system\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    06a9cdfe44e4c18590ee9c7f61222516

    SHA1

    46a86da27b781b039e6a434f990a899d1e7022ac

    SHA256

    f58787f71f00910d40f58ff1ed9b9e627bc52e074261f628b996d4cc69ec144c

    SHA512

    e3ed9735555fd6386a85245bc8bb6da49d6fd9614b91a8e7975325348d2232d7e13fceb16c500e75e92da62f017149711665ceb961a5f78f80a8c6e28f3ba6f7

  • C:\Windows\system\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    06a9cdfe44e4c18590ee9c7f61222516

    SHA1

    46a86da27b781b039e6a434f990a899d1e7022ac

    SHA256

    f58787f71f00910d40f58ff1ed9b9e627bc52e074261f628b996d4cc69ec144c

    SHA512

    e3ed9735555fd6386a85245bc8bb6da49d6fd9614b91a8e7975325348d2232d7e13fceb16c500e75e92da62f017149711665ceb961a5f78f80a8c6e28f3ba6f7

  • C:\Windows\system\services.exe

    Filesize

    278KB

    MD5

    9f418a7b388c384b2ebe1dd3ee78b575

    SHA1

    c6ed2d0d6a3ca75fb3fef44dcfa08cb9a2f1ea8a

    SHA256

    e38c6474075540c09392be7dfe31ee8622daf2534139d6d9d1a08c8224db5efb

    SHA512

    3e7477e00b2efcaf0decce7653a7620df06a92f0bf201089940abbfea5f4027cc920db98e51b4ab8970b7d36b22320e1313c643f39c8e28869f41a22adae7da6

  • C:\Windows\system\services.exe

    Filesize

    278KB

    MD5

    9f418a7b388c384b2ebe1dd3ee78b575

    SHA1

    c6ed2d0d6a3ca75fb3fef44dcfa08cb9a2f1ea8a

    SHA256

    e38c6474075540c09392be7dfe31ee8622daf2534139d6d9d1a08c8224db5efb

    SHA512

    3e7477e00b2efcaf0decce7653a7620df06a92f0bf201089940abbfea5f4027cc920db98e51b4ab8970b7d36b22320e1313c643f39c8e28869f41a22adae7da6

  • C:\Windows\system\services.ini

    Filesize

    102B

    MD5

    548bc20812a0cdcfa4a861232a9b4017

    SHA1

    a58180d21b859715fb42a6a489ac1ce57211cb3c

    SHA256

    66c7eded72b0d265144f43620a4ad8837ca0a43a3306c95ec7e662c90a13f35b

    SHA512

    23388083dfd84adc13d2505313dff598b172732aa532df11690881741bbd6551c1540c1d4eb19805c10e98ef271a7551996ae7ca86c97df85981f45be92ad3fa

  • C:\Windows\system\services.ini

    Filesize

    102B

    MD5

    548bc20812a0cdcfa4a861232a9b4017

    SHA1

    a58180d21b859715fb42a6a489ac1ce57211cb3c

    SHA256

    66c7eded72b0d265144f43620a4ad8837ca0a43a3306c95ec7e662c90a13f35b

    SHA512

    23388083dfd84adc13d2505313dff598b172732aa532df11690881741bbd6551c1540c1d4eb19805c10e98ef271a7551996ae7ca86c97df85981f45be92ad3fa

  • C:\spysilici.bat

    Filesize

    88B

    MD5

    92bb45e44e75f94c8b586d8149eb41fc

    SHA1

    158c6ec92ab009ef40febcefd0e602f89cf722db

    SHA256

    4c7364a9111b7fc49e1a5a93b0e7022f9c6cc783c59063136d0d921571285f44

    SHA512

    0510ee2f301e3cd3155e024e4c5684b80d40fe055bb8be21638fc3ad8dfb37d4af7803fdafdef11de3c20ca758a634847a19a5cb7dcdcef09e29737dbe8ee59c

  • memory/224-161-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/224-163-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1120-143-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1120-132-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2176-151-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/3336-152-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/3336-157-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB