Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
228s -
max time network
233s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2022, 07:01
Static task
static1
Behavioral task
behavioral1
Sample
unknown.exe
Resource
win10v2004-20220901-en
General
-
Target
unknown.exe
-
Size
1.9MB
-
MD5
9d3b27b3a999b235deceb897431d9cad
-
SHA1
caf056a08abe9dc8dc63ccb93609ad811c248937
-
SHA256
0fa41ef1fdafc8802949cc226b5ef2f8986ce09d2b26f0562b18b4a62c459609
-
SHA512
a695f864a69112b6ffed501c2b2fa0652106915e9292c64b005fc668bc0b4f7ece0b2cfe5a525cf018c0389b65f32e12a29376d50689573d6322ee486562cb6e
-
SSDEEP
24576:u7FUDowAyrTVE3U5FmqT7z1klhAhH6m5x7awFhJdNo69lOy7KTijlA:uBuZrEUL3ilhAZv55DdN7POGjG
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4340 unknown.tmp 2552 unknown.tmp -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation unknown.tmp -
Loads dropped DLL 2 IoCs
pid Process 4340 unknown.tmp 2552 unknown.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 217.160.70.42 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2552 set thread context of 4516 2552 unknown.tmp 86 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\PC_installer\unins000.dat unknown.tmp File created C:\Program Files (x86)\PC_installer\is-F8ASV.tmp unknown.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3148 4516 WerFault.exe 86 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2552 unknown.tmp 2552 unknown.tmp 2552 unknown.tmp 2552 unknown.tmp 2552 unknown.tmp 2552 unknown.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 unknown.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 4340 2056 unknown.exe 82 PID 2056 wrote to memory of 4340 2056 unknown.exe 82 PID 2056 wrote to memory of 4340 2056 unknown.exe 82 PID 4340 wrote to memory of 4540 4340 unknown.tmp 84 PID 4340 wrote to memory of 4540 4340 unknown.tmp 84 PID 4340 wrote to memory of 4540 4340 unknown.tmp 84 PID 4540 wrote to memory of 2552 4540 unknown.exe 85 PID 4540 wrote to memory of 2552 4540 unknown.exe 85 PID 4540 wrote to memory of 2552 4540 unknown.exe 85 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86 PID 2552 wrote to memory of 4516 2552 unknown.tmp 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\unknown.exe"C:\Users\Admin\AppData\Local\Temp\unknown.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\is-8G232.tmp\unknown.tmp"C:\Users\Admin\AppData\Local\Temp\is-8G232.tmp\unknown.tmp" /SL5="$E01BA,1133818,832512,C:\Users\Admin\AppData\Local\Temp\unknown.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\unknown.exe"C:\Users\Admin\AppData\Local\Temp\unknown.exe" /VERYSILENT3⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\is-MDCVI.tmp\unknown.tmp"C:\Users\Admin\AppData\Local\Temp\is-MDCVI.tmp\unknown.tmp" /SL5="$F01BA,1133818,832512,C:\Users\Admin\AppData\Local\Temp\unknown.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe 995⤵PID:4516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 9046⤵
- Program crash
PID:3148
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4516 -ip 45161⤵PID:2284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5e8bbd5425ac1507a72fad12f513135d0
SHA16700c181e93d7787df9bd930dc37bcc1c29306c7
SHA256f49aefb68a1e66c0b6454e9ce51430229f68e8c644dd2de60def4029f204978f
SHA5128cf9eaaf6e0d56688bffa7646ed6bfbefeb6aad4e6b66a00f7f580285f559b8b31e7883774bbe6999b4dfab5b11b10743bcda4be71016f29c5eb29fea523db71
-
Filesize
368KB
MD50df6a0de449cbc0f3331b33fbfc5b7c0
SHA13e41ade403f19ed56773bf8c1a365bd02adae0d1
SHA25649f22332c61975e05449bd2eb9b800e213bc0808ef4c2d26e0af3bdd3f7fc396
SHA51280ca7b46d3ee300a600790be88d7476861b4ba0b9f1da5e6529df4005aed89246ec05d31e40b89e41d17c7880e36f8c2d82fa5e47186abb36c1abf04e6001737
-
Filesize
368KB
MD50df6a0de449cbc0f3331b33fbfc5b7c0
SHA13e41ade403f19ed56773bf8c1a365bd02adae0d1
SHA25649f22332c61975e05449bd2eb9b800e213bc0808ef4c2d26e0af3bdd3f7fc396
SHA51280ca7b46d3ee300a600790be88d7476861b4ba0b9f1da5e6529df4005aed89246ec05d31e40b89e41d17c7880e36f8c2d82fa5e47186abb36c1abf04e6001737
-
Filesize
3.0MB
MD5e8bbd5425ac1507a72fad12f513135d0
SHA16700c181e93d7787df9bd930dc37bcc1c29306c7
SHA256f49aefb68a1e66c0b6454e9ce51430229f68e8c644dd2de60def4029f204978f
SHA5128cf9eaaf6e0d56688bffa7646ed6bfbefeb6aad4e6b66a00f7f580285f559b8b31e7883774bbe6999b4dfab5b11b10743bcda4be71016f29c5eb29fea523db71
-
Filesize
3.0MB
MD5e8bbd5425ac1507a72fad12f513135d0
SHA16700c181e93d7787df9bd930dc37bcc1c29306c7
SHA256f49aefb68a1e66c0b6454e9ce51430229f68e8c644dd2de60def4029f204978f
SHA5128cf9eaaf6e0d56688bffa7646ed6bfbefeb6aad4e6b66a00f7f580285f559b8b31e7883774bbe6999b4dfab5b11b10743bcda4be71016f29c5eb29fea523db71