Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 14:51
Static task
static1
Behavioral task
behavioral1
Sample
3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe
Resource
win10v2004-20220812-en
General
-
Target
3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe
-
Size
251KB
-
MD5
66257a85aecf2e05f1f6c729e250a460
-
SHA1
2d11f10cf55b124356ea53bd1f030292b68f20ac
-
SHA256
3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b
-
SHA512
bd6e832a330efa4450622f1ee85b92dc2e7826b6f0894eb83f9242a641aea5a1603bc6e0e19ef16c20256bb5dcab86aba3116c1a0a33dd1594bd9d9cb784d69b
-
SSDEEP
3072:zI36iNfhv+XWwKWDzN2izzUDm6QpzJ8f2mMsfzVLmC4DGYD1VIT2U2Z:zI366+XWwKWDzTIDmDsdfz4ClY4T2U2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1372 windows.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4904 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecc7c8c51c0850c1ec247c7fd3602f20.exe windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecc7c8c51c0850c1ec247c7fd3602f20.exe windows.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe 1372 windows.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1372 windows.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1372 1732 3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe 83 PID 1732 wrote to memory of 1372 1732 3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe 83 PID 1732 wrote to memory of 1372 1732 3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe 83 PID 1372 wrote to memory of 4904 1372 windows.exe 84 PID 1372 wrote to memory of 4904 1372 windows.exe 84 PID 1372 wrote to memory of 4904 1372 windows.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe"C:\Users\Admin\AppData\Local\Temp\3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:4904
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD566257a85aecf2e05f1f6c729e250a460
SHA12d11f10cf55b124356ea53bd1f030292b68f20ac
SHA2563a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b
SHA512bd6e832a330efa4450622f1ee85b92dc2e7826b6f0894eb83f9242a641aea5a1603bc6e0e19ef16c20256bb5dcab86aba3116c1a0a33dd1594bd9d9cb784d69b
-
Filesize
251KB
MD566257a85aecf2e05f1f6c729e250a460
SHA12d11f10cf55b124356ea53bd1f030292b68f20ac
SHA2563a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b
SHA512bd6e832a330efa4450622f1ee85b92dc2e7826b6f0894eb83f9242a641aea5a1603bc6e0e19ef16c20256bb5dcab86aba3116c1a0a33dd1594bd9d9cb784d69b