Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2022, 19:47

General

  • Target

    771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe

  • Size

    59KB

  • MD5

    6fd49e78e842ad294701332392cfcf87

  • SHA1

    5afd01afe8a25b434b603bdede319d9383c165e4

  • SHA256

    771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b

  • SHA512

    a13699d4b78ae28dc4a4ec9480900761c41307f8452e2d4eef66220210bd7f57224a3c3983be8544fadb8b84f0b153ce0def95b0e2971b6399d49c4a5900b35a

  • SSDEEP

    1536:9+1MKLlB0OcRUM0+siQr5MCgj/rSLsybOOb:ZKRB0vUX+siQr5Mf/8b

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 30 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
    "C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Drops file in System32 directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\regedit.exe
      C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
      2⤵
      • Adds Run key to start application
      • Runs .reg file with regedit
      PID:4440
    • C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
      C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Windows\SysWOW64\regedit.exe
        C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
        3⤵
        • Adds Run key to start application
        • Runs .reg file with regedit
        PID:1280

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\msscp.reg

    Filesize

    186B

    MD5

    97bb432b5cae0536bff55662c52b9c12

    SHA1

    961f2656f1cdf0f259aabdbbf8153c5b77e773b2

    SHA256

    44838bc72e7c1cfd43b7b93618c322a495d12354f996763dce55ac0be3f6db8b

    SHA512

    d6bd0f9f9e44777c1e622205e39c4bbde340e742fb6f947e6829d47f3a3f278a74b670452293fd8542d617e60161e2245d9f4ead5ab531fe2214008c734f8a46

  • C:\Windows\SysWOW64\msscp.reg

    Filesize

    186B

    MD5

    97bb432b5cae0536bff55662c52b9c12

    SHA1

    961f2656f1cdf0f259aabdbbf8153c5b77e773b2

    SHA256

    44838bc72e7c1cfd43b7b93618c322a495d12354f996763dce55ac0be3f6db8b

    SHA512

    d6bd0f9f9e44777c1e622205e39c4bbde340e742fb6f947e6829d47f3a3f278a74b670452293fd8542d617e60161e2245d9f4ead5ab531fe2214008c734f8a46

  • memory/2248-137-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2248-139-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4636-138-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB