Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 16:23
Static task
static1
Behavioral task
behavioral1
Sample
8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe
Resource
win10v2004-20220901-en
General
-
Target
8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe
-
Size
112KB
-
MD5
68a98b2a13fda3c7d1f29e512ef5c52e
-
SHA1
a3b9520cad3cc9db6433ca57bc745781fd1418d7
-
SHA256
8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197
-
SHA512
f311052633089917b79b42f682438e7f388d4e4d53d79660a97f36672b5a6256b6a79d20575d2833f6f4462319f4f435b5c4d5105b16d4b10653a70982cc0eac
-
SSDEEP
1536:E9wrhoUwQFkQZI2LSkS+yiPmuHS/UWrUuOOJE5fiExEENYaIT8fvyJ:E9wuQmQegjTHScWrUmJElxEEC6v
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3732 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3732 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5028 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5028 wrote to memory of 1460 5028 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe 84 PID 5028 wrote to memory of 1460 5028 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe 84 PID 5028 wrote to memory of 1460 5028 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe 84 PID 1460 wrote to memory of 3732 1460 cmd.exe 86 PID 1460 wrote to memory of 3732 1460 cmd.exe 86 PID 1460 wrote to memory of 3732 1460 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe"C:\Users\Admin\AppData\Local\Temp\8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 8a28a1d91e732a6310d30f430e970c1b652⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-