Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 15:17

General

  • Target

    09099d9690d6e1fd353716175c33fc8840e71403928e4f59e1525b6c2bcfaf1a.exe

  • Size

    535KB

  • MD5

    6cfc2c513d965e191ee0f6cc5380f633

  • SHA1

    ffce1a122092a81970ddd657ead6b40fe1af5f89

  • SHA256

    09099d9690d6e1fd353716175c33fc8840e71403928e4f59e1525b6c2bcfaf1a

  • SHA512

    4a7f50ba6ebb89a5f8990c262a1a3028747900ec4edf120c54b49f90a729b57051c4f451f2e2d6edd39642fb443f0d9dae950245acd5df85b1d8b36c43859032

  • SSDEEP

    6144:/MSGDR10FgQV7sssO8hGDJkhpe1pq5yLheAn+KiNgiJlRfcln/kK/4ZP7xYh:a0n7ss66wpyKyL93+Jaln/kK/49lm

Score
8/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09099d9690d6e1fd353716175c33fc8840e71403928e4f59e1525b6c2bcfaf1a.exe
    "C:\Users\Admin\AppData\Local\Temp\09099d9690d6e1fd353716175c33fc8840e71403928e4f59e1525b6c2bcfaf1a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Users\Admin\AppData\Local\Temp\09099d9690d6e1fd353716175c33fc8840e71403928e4f59e1525b6c2bcfaf1a.exe
      "C:\Users\Admin\AppData\Local\Temp\09099d9690d6e1fd353716175c33fc8840e71403928e4f59e1525b6c2bcfaf1a.exe" "C:\Users\Admin\AppData\Local\Temp\09099d9690d6e1fd353716175c33fc8840e71403928e4f59e1525b6c2bcfaf1a.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Checks for any installed AV software in registry
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM MSASCui* /IM avg* /IM ash* /IM McSA* /IM msse*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4884

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1996-133-0x0000000000400000-0x0000000000489000-memory.dmp

    Filesize

    548KB

  • memory/1996-135-0x0000000000400000-0x0000000000489000-memory.dmp

    Filesize

    548KB

  • memory/1996-137-0x0000000000400000-0x0000000000489000-memory.dmp

    Filesize

    548KB

  • memory/1996-139-0x0000000000400000-0x0000000000489000-memory.dmp

    Filesize

    548KB

  • memory/1996-140-0x0000000000650000-0x00000000006DD000-memory.dmp

    Filesize

    564KB

  • memory/1996-141-0x0000000000650000-0x00000000006DD000-memory.dmp

    Filesize

    564KB