Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
108s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe
Resource
win10v2004-20220901-en
General
-
Target
4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe
-
Size
77KB
-
MD5
46a7adef5f42adb71c0a564a08b2e480
-
SHA1
d6eaafffed5a036ff5a39fd74ffb593a5761c9c3
-
SHA256
4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b
-
SHA512
32e2ca79c5388dbd3ee08f613718a811b3ac23b1518065c348b77015c972d4848fbc1d2028df15232cb031932e51bbcc65a093120a6d5448d18ddbc983bb1f90
-
SSDEEP
1536:GdRIW39QfiyfOGHkz/ojIELeTsToxg7PQi3U:GXz394EE8DwExerU
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2232 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2232 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4760 4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4760 wrote to memory of 716 4760 4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe 84 PID 4760 wrote to memory of 716 4760 4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe 84 PID 4760 wrote to memory of 716 4760 4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe 84 PID 716 wrote to memory of 2232 716 cmd.exe 86 PID 716 wrote to memory of 2232 716 cmd.exe 86 PID 716 wrote to memory of 2232 716 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe"C:\Users\Admin\AppData\Local\Temp\4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 4c2b0d3c58837aea5429cc4520a37b15072e319277681c5f8c96c8078e422a7b.exe2⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-