Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 08:37
Static task
static1
Behavioral task
behavioral1
Sample
c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe
Resource
win10v2004-20220812-en
General
-
Target
c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe
-
Size
85KB
-
MD5
091bcddb5ceaa1f0c7e2d507c539c60f
-
SHA1
e3cf67fe5611716ef26de6a18042500d9cfc4c39
-
SHA256
c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb
-
SHA512
61ccb06ae2a9cdec6ce919578edb6f598ba78c67b1a0426add56584676299009f3f33043f149608be5d8ff649edebbdae0d1f53045d26753f7c6af31a846a43a
-
SSDEEP
1536:5JXLSNZSOyF/lewor4ZXkl3CkSRpliHyPm:5FutyjfVxIyLiS
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\424927117 = "C:\\Users\\Admin\\424927117.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "174" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe Token: SeShutdownPrivilege 3656 shutdown.exe Token: SeRemoteShutdownPrivilege 3656 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2984 LogonUI.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 828 wrote to memory of 1768 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe 82 PID 828 wrote to memory of 1768 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe 82 PID 828 wrote to memory of 1768 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe 82 PID 1768 wrote to memory of 4400 1768 cmd.exe 84 PID 1768 wrote to memory of 4400 1768 cmd.exe 84 PID 1768 wrote to memory of 4400 1768 cmd.exe 84 PID 828 wrote to memory of 3656 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe 85 PID 828 wrote to memory of 3656 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe 85 PID 828 wrote to memory of 3656 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe 85 PID 828 wrote to memory of 2620 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe 87 PID 828 wrote to memory of 2620 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe 87 PID 828 wrote to memory of 2620 828 c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe"C:\Users\Admin\AppData\Local\Temp\c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 424927117 /t REG_SZ /d "%userprofile%\424927117.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 424927117 /t REG_SZ /d "C:\Users\Admin\424927117.exe" /f3⤵
- Adds Run key to start application
PID:4400
-
-
-
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /f /t 32⤵
- Suspicious use of AdjustPrivilegeToken
PID:3656
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C352D1~1.EXE > nul2⤵PID:2620
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39f6855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2984