Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 20:57
Static task
static1
Behavioral task
behavioral1
Sample
26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe
-
Size
1.2MB
-
MD5
08463f0dc14da43be6b1b0afd8c75049
-
SHA1
83f1567f4bcbedbb6290a4887c79682e72b04502
-
SHA256
26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4
-
SHA512
abf43c220565de707c074197e442e6901da030dcba45f01d6fb0f71fb0a3f9e7f18c2e77e1db904c44c7bd4f5054e866efa182ef4bee30ce3b0556154ef50240
-
SSDEEP
24576:KTeZ1PDQhGJ5k29ZWT2wuIB14MvwzEULrwMs4G:5DU05k2Q7oMlww4
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\SysWOW64\Regedit.exe 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\SysWOW64\0409 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Program Files\7-Zip 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Bfsvc.exe 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Rescache\_merged 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Systemapps\Microsoft.Aad.Brokerplugin_cw5n1h2txyewy 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\fr-FR 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Immersivecontrolpanel 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Printdialog\Assets 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Shellexperiences 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Servicing 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Setup 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Waas 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Remotepackages 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Resources\Ease of Access Themes 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Schemas\Availablenetwork 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Rescache 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Resources 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Softwaredistribution 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Winsxs 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\de-DE 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Identitycrl\Int 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Inputmethod\Chs 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Performance\Winsat 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\IME 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\ModemLogs 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Registration\Crmlog 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Security\Applicationid 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Twain_32 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\bfsvc.exe 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\IdentityCRL 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Es-Es 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Livekernelreports 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Policydefinitions 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Servicing\De-De 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\DigitalLocker 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Appcompat 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Assembly 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Cursors 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Digitallocker\En-Us 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Ja-Jp 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\L2Schemas 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Microsoft.Net 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Panther 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Apppatch 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Branding 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Diagtrack 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Remotepackages\Remoteapps 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\explorer.exe 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\PolicyDefinitions 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Professional.xml 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Immersivecontrolpanel\De-De 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Tasks 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\appcompat 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Lsasetup.log 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Addins 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Containers\Serviced 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Debug 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\es-ES 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Boot 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Inf 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Speech 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Logs\Cbs 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Schemas 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Systemresources\Callingshellapp 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\HelpPane.exe 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe File opened for modification C:\Windows\Containers 26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe"C:\Users\Admin\AppData\Local\Temp\26f1ed107ce0852473c70f81fec1d761de9643dbff0ddce52137b2b31b0113b4.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2896