Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 15:19
Static task
static1
Behavioral task
behavioral1
Sample
04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87.exe
Resource
win10v2004-20220901-en
General
-
Target
04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87.exe
-
Size
143KB
-
MD5
66839a5f934952806eea150d2a022140
-
SHA1
f727ff85a05706b1f36ff9aa8eedba1547768ceb
-
SHA256
04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87
-
SHA512
40846ef26183488b0e5e6b4840da89d5e4137a912712c6024a95650205ccc1dddaf65cae7982f8655a2426ed082009fa06c0c33d123efce6207ce1854d25b17b
-
SSDEEP
3072:YCm/+JvYipDHV4pG6XM8ouZ3bsrDVtWp1MDyGDQcPgOAJocmBeAyBdXRPXyNx7kP:YCm/+JvrDHVGG6X6uZ3bsrJtWp1MDyG7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1412 mamidou.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 220 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\35af8da62bb26afe6fa37507b3281eec.exe mamidou.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\35af8da62bb26afe6fa37507b3281eec.exe mamidou.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\35af8da62bb26afe6fa37507b3281eec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mamidou.exe\" .." mamidou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\35af8da62bb26afe6fa37507b3281eec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mamidou.exe\" .." mamidou.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe 1412 mamidou.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1412 mamidou.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3944 wrote to memory of 1412 3944 04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87.exe 84 PID 3944 wrote to memory of 1412 3944 04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87.exe 84 PID 3944 wrote to memory of 1412 3944 04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87.exe 84 PID 1412 wrote to memory of 220 1412 mamidou.exe 85 PID 1412 wrote to memory of 220 1412 mamidou.exe 85 PID 1412 wrote to memory of 220 1412 mamidou.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87.exe"C:\Users\Admin\AppData\Local\Temp\04f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\mamidou.exe"C:\Users\Admin\AppData\Local\Temp\mamidou.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\mamidou.exe" "mamidou.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:220
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143KB
MD566839a5f934952806eea150d2a022140
SHA1f727ff85a05706b1f36ff9aa8eedba1547768ceb
SHA25604f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87
SHA51240846ef26183488b0e5e6b4840da89d5e4137a912712c6024a95650205ccc1dddaf65cae7982f8655a2426ed082009fa06c0c33d123efce6207ce1854d25b17b
-
Filesize
143KB
MD566839a5f934952806eea150d2a022140
SHA1f727ff85a05706b1f36ff9aa8eedba1547768ceb
SHA25604f7a8e9a8a1031fe34496d0729f8eef3f9fa6d04b9369116fdd7aeab95a3e87
SHA51240846ef26183488b0e5e6b4840da89d5e4137a912712c6024a95650205ccc1dddaf65cae7982f8655a2426ed082009fa06c0c33d123efce6207ce1854d25b17b