Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe
Resource
win7-20220812-en
General
-
Target
2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe
-
Size
390KB
-
MD5
6b990e2a7cdf89f93d4f7fc977224f1c
-
SHA1
3b5b87866f0b73f465763ebf7c7f49c7f026758c
-
SHA256
2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc
-
SHA512
db40969d543cfc009e27f26744617e995d738d30abc6f1f7a61d31a4cca5fbd6a29db8ffa8b65ed81a0c3efcc9b8f397da25a9529ad765ce7cae71d49d7873d8
-
SSDEEP
6144:ebDJSegYiFS3rBkr7IlcssWLrfqKTmDFmUr4H0JXJHtgxOZ9Em9Evl:e7gN0r+0DsCqVvkH0JXJHEOZ1Wvl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3308 SO-MoneyHack v2.0.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 whatismyip.akamai.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3308 SO-MoneyHack v2.0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3308 SO-MoneyHack v2.0.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3308 SO-MoneyHack v2.0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2132 wrote to memory of 3308 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 84 PID 2132 wrote to memory of 3308 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 84 PID 2132 wrote to memory of 3308 2132 2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe"C:\Users\Admin\AppData\Local\Temp\2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\SO-MoneyHack v2.0.exe"C:\Users\Admin\AppData\Local\Temp\SO-MoneyHack v2.0.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3308
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300KB
MD568f0dbc20c592161fad427c472f4e61f
SHA1e0119274e1f14d136324bb6b3e5bde87bf999b3f
SHA256479a30d7ee0286c2742dcc38422dc192b5bc0b60afa91ab51d7933060f41bb66
SHA512b7e5cd20cda2266e710e948cf832f799949dab9421098cff78adf1f6f296903bd2a0833c4eae24729173a6275c0434cd13ad682f0056086f2c89a4ae3042bd38
-
Filesize
300KB
MD568f0dbc20c592161fad427c472f4e61f
SHA1e0119274e1f14d136324bb6b3e5bde87bf999b3f
SHA256479a30d7ee0286c2742dcc38422dc192b5bc0b60afa91ab51d7933060f41bb66
SHA512b7e5cd20cda2266e710e948cf832f799949dab9421098cff78adf1f6f296903bd2a0833c4eae24729173a6275c0434cd13ad682f0056086f2c89a4ae3042bd38