Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 11:54

General

  • Target

    659782eab979aeb7b09d2b76171776c06b8141048dfca85224627bd00111be7e.exe

  • Size

    116KB

  • MD5

    3f225d6d4492043a1eeafaacd4f0cb8b

  • SHA1

    de75e29bc7160eb0810fb87adfaf4652b1fa63f6

  • SHA256

    659782eab979aeb7b09d2b76171776c06b8141048dfca85224627bd00111be7e

  • SHA512

    eeb3cda23d4d28118c751988f0ee8ab432891a87947fa2f0082ba52c579ae859a99efcc30c95836c026338145a0020c3d10592a2fb40c08916f9c0bc26a745a3

  • SSDEEP

    1536:FMFwEKzi2EcPPH3BoyeoI/BYEFuZ7AaAxciGXww0nu+JL8z0YfC6jlnV3uuayKXS:OyEA7pPRo34Z0/x4gvnuULSLFAqC0r

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\659782eab979aeb7b09d2b76171776c06b8141048dfca85224627bd00111be7e.exe
    "C:\Users\Admin\AppData\Local\Temp\659782eab979aeb7b09d2b76171776c06b8141048dfca85224627bd00111be7e.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Cwp..bat" > nul 2> nul
      2⤵
        PID:4896

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Cwp..bat

      Filesize

      274B

      MD5

      5d1b8135d1c56d103c93897b7cea9d2f

      SHA1

      985e650eb5be75e0772c97612c7dcdbd7d468110

      SHA256

      083ddd2997bc53d962a7d45fb6c57592ef7fe1320b2e44c86a1be7c2ae5d9f30

      SHA512

      27936589552d224772e35cea7a88459d636b24803a017f6aebaaa8e6a1fa990918a3f3485be2688e320440992421bb6952514bb25f0fb2bc5d080a4e3d0289a1

    • memory/932-132-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

    • memory/932-134-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB