Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe
Resource
win10v2004-20220812-en
General
-
Target
2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe
-
Size
497KB
-
MD5
6ba5330e30af3e475c35aa4e1a3bcae0
-
SHA1
2414a6af54bb9060137658c3a0630519d12aa058
-
SHA256
2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1
-
SHA512
5e65b25ce88e3ee613a490141462fad0e5dfe01e1233469be9bdf1b1ba3d542edc1bb6c81774f4300fd8638d98f9b5736c200396c657715968646d289e04e2a6
-
SSDEEP
12288:DanhSbDK5mZQK7aXPVBl4WL0w+UdfifU/dUuP/ycV9n+A:DagbDKWF+/VBl4WL0MfSQ/yY+
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\233300\\sysmon.exe\"" sysmon.exe -
Executes dropped EXE 2 IoCs
pid Process 3572 sysmon.exe 3528 sysmon.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System Monitor = "\"C:\\ProgramData\\233300\\sysmon.exe\"" sysmon.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2876 set thread context of 228 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 88 PID 3572 set thread context of 3528 3572 sysmon.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 3796 2876 WerFault.exe 81 2700 3572 WerFault.exe 93 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 3572 sysmon.exe 3572 sysmon.exe 3572 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe 3528 sysmon.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe Token: SeDebugPrivilege 3572 sysmon.exe Token: SeDebugPrivilege 3528 sysmon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3528 sysmon.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2876 wrote to memory of 1472 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 84 PID 2876 wrote to memory of 1472 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 84 PID 2876 wrote to memory of 1472 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 84 PID 2876 wrote to memory of 4576 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 85 PID 2876 wrote to memory of 4576 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 85 PID 2876 wrote to memory of 4576 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 85 PID 2876 wrote to memory of 3008 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 86 PID 2876 wrote to memory of 3008 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 86 PID 2876 wrote to memory of 3008 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 86 PID 2876 wrote to memory of 216 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 87 PID 2876 wrote to memory of 216 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 87 PID 2876 wrote to memory of 216 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 87 PID 2876 wrote to memory of 228 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 88 PID 2876 wrote to memory of 228 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 88 PID 2876 wrote to memory of 228 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 88 PID 2876 wrote to memory of 228 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 88 PID 2876 wrote to memory of 228 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 88 PID 2876 wrote to memory of 228 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 88 PID 2876 wrote to memory of 228 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 88 PID 2876 wrote to memory of 228 2876 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 88 PID 228 wrote to memory of 3572 228 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 93 PID 228 wrote to memory of 3572 228 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 93 PID 228 wrote to memory of 3572 228 2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe 93 PID 3572 wrote to memory of 3528 3572 sysmon.exe 96 PID 3572 wrote to memory of 3528 3572 sysmon.exe 96 PID 3572 wrote to memory of 3528 3572 sysmon.exe 96 PID 3572 wrote to memory of 3528 3572 sysmon.exe 96 PID 3572 wrote to memory of 3528 3572 sysmon.exe 96 PID 3572 wrote to memory of 3528 3572 sysmon.exe 96 PID 3572 wrote to memory of 3528 3572 sysmon.exe 96 PID 3572 wrote to memory of 3528 3572 sysmon.exe 96 PID 3528 wrote to memory of 2700 3528 sysmon.exe 98 PID 3528 wrote to memory of 2700 3528 sysmon.exe 98 PID 3528 wrote to memory of 2700 3528 sysmon.exe 98 PID 3528 wrote to memory of 2700 3528 sysmon.exe 98 PID 3528 wrote to memory of 2700 3528 sysmon.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"2⤵PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"2⤵PID:4576
-
-
C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"2⤵PID:3008
-
-
C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"2⤵PID:216
-
-
C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"C:\Users\Admin\AppData\Local\Temp\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228 -
C:\ProgramData\233300\sysmon.exe"C:\ProgramData\233300\sysmon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\ProgramData\233300\sysmon.exe"C:\ProgramData\233300\sysmon.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 10804⤵
- Program crash
PID:2700
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 11282⤵
- Program crash
PID:3796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2876 -ip 28761⤵PID:1416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3572 -ip 35721⤵PID:4116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
497KB
MD56ba5330e30af3e475c35aa4e1a3bcae0
SHA12414a6af54bb9060137658c3a0630519d12aa058
SHA2562882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1
SHA5125e65b25ce88e3ee613a490141462fad0e5dfe01e1233469be9bdf1b1ba3d542edc1bb6c81774f4300fd8638d98f9b5736c200396c657715968646d289e04e2a6
-
Filesize
497KB
MD56ba5330e30af3e475c35aa4e1a3bcae0
SHA12414a6af54bb9060137658c3a0630519d12aa058
SHA2562882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1
SHA5125e65b25ce88e3ee613a490141462fad0e5dfe01e1233469be9bdf1b1ba3d542edc1bb6c81774f4300fd8638d98f9b5736c200396c657715968646d289e04e2a6
-
Filesize
497KB
MD56ba5330e30af3e475c35aa4e1a3bcae0
SHA12414a6af54bb9060137658c3a0630519d12aa058
SHA2562882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1
SHA5125e65b25ce88e3ee613a490141462fad0e5dfe01e1233469be9bdf1b1ba3d542edc1bb6c81774f4300fd8638d98f9b5736c200396c657715968646d289e04e2a6
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\2882a6849d0575304fec7666418dd986d56129dfe69060df09c6cb513a3617d1.exe.log
Filesize400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307