Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
200s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe
Resource
win10v2004-20220812-en
General
-
Target
97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe
-
Size
69KB
-
MD5
6cbb2ef706bd5e08ec0f83844b5b7ee0
-
SHA1
90e2964a0f13a2e052efb1436a5613ad29023402
-
SHA256
97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d
-
SHA512
7c958cc8b838baa871c6a8156c92134532e04148032af617582a842f1ad54981c03d54a78ca96399c32c9bbcfad84be76b238be77ffa81111ca507572d7c975d
-
SSDEEP
1536:rJCKOXfuGsRf1kQtnSe+L6ZtTqI1RfXTO:rofX2GsRf1vSBCt71RfD
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\I: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\K: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\R: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\U: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\V: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\W: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\F: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\X: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\H: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\J: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\L: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\N: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\S: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\Z: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\E: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\M: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\T: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\B: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\O: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\P: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\Q: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\Y: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\A: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\setupcln\setuperr.log 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagerr.xml 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagwrn.xml 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\setupact.log 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.