Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 07:36
Static task
static1
Behavioral task
behavioral1
Sample
4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe
Resource
win10v2004-20220812-en
General
-
Target
4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe
-
Size
44KB
-
MD5
63fb6a6c26832825086d4ff5727153a0
-
SHA1
a32088b47bcc5dca84965cf10e17f73e92e2979b
-
SHA256
4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf
-
SHA512
13cf6a2a56779b8300f9291afda1ddcec260a96a1a9844284a687f1e3bdbbd9231edf23db8927d43644325edca6309e522e60c741ef65b51929a4ab0b8fb3e0f
-
SSDEEP
384:cbE8r54uJsHa0NLnIzx0x2b2vjPxz3w8Du3jsBYRAGryf4pxI/6ps2QdhA4I7m36:eE8auAakDI90Ksw8gpyf4pxGAv5N
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4692 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4692 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 724 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 724 wrote to memory of 4360 724 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe 82 PID 724 wrote to memory of 4360 724 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe 82 PID 724 wrote to memory of 4360 724 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe 82 PID 4360 wrote to memory of 4692 4360 cmd.exe 84 PID 4360 wrote to memory of 4692 4360 cmd.exe 84 PID 4360 wrote to memory of 4692 4360 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe"C:\Users\Admin\AppData\Local\Temp\4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-