Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 13:49
Static task
static1
Behavioral task
behavioral1
Sample
446d8344df2d21106b51d808ec1a24a66cf282de8a584161ac5f7e86ffb7b7bf.lnk
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
446d8344df2d21106b51d808ec1a24a66cf282de8a584161ac5f7e86ffb7b7bf.lnk
Resource
win10v2004-20220812-en
General
-
Target
446d8344df2d21106b51d808ec1a24a66cf282de8a584161ac5f7e86ffb7b7bf.lnk
-
Size
800B
-
MD5
72191ad6fdb0a56b472342d3aac80d20
-
SHA1
906fc37a695fc815e5ddda626bff407ff8261796
-
SHA256
446d8344df2d21106b51d808ec1a24a66cf282de8a584161ac5f7e86ffb7b7bf
-
SHA512
80727448c47de403b3c07b660eb58e2104f8686e98ff88266ed977b8f312e722f5da30e0c63ab855e71d0d9a020b0e86827bf40c7d28159b30bd982c959993c8
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4284 wrote to memory of 4584 4284 cmd.exe 84 PID 4284 wrote to memory of 4584 4284 cmd.exe 84
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\446d8344df2d21106b51d808ec1a24a66cf282de8a584161ac5f7e86ffb7b7bf.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" \5appa55a.ua0.p5k0fak0.pfu.kp5kku.aa0.p5k05uak.fffffk,kkkkkkkkkkkkkkk52⤵PID:4584
-