Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 02:48
Static task
static1
Behavioral task
behavioral1
Sample
6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe
Resource
win10v2004-20220812-en
General
-
Target
6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe
-
Size
148KB
-
MD5
6924595ad703c1555efacfbdb548df50
-
SHA1
05f148c8f9bd9214a06e018834adfb96b31d2d0b
-
SHA256
6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da
-
SHA512
6388b5d1f1af7b495f44ef9484904203d19b8fea948665dec435c282635b4ff80c7046a3864ef063a429be9acea53517ab733dd7e5b8781f24de96e81fae8274
-
SSDEEP
3072:mmqgvg5gRdVmzz92fZ4iUP0xQJeLe0ex8qI:UGdVsxgZ4NcxQJeLe0ex8q
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4360 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4360 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1108 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1108 wrote to memory of 460 1108 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe 84 PID 1108 wrote to memory of 460 1108 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe 84 PID 1108 wrote to memory of 460 1108 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe 84 PID 460 wrote to memory of 4360 460 cmd.exe 86 PID 460 wrote to memory of 4360 460 cmd.exe 86 PID 460 wrote to memory of 4360 460 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe"C:\Users\Admin\AppData\Local\Temp\6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 6c880ff92273e4f0ea9bb971d0a0a34bc72⤵
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-