Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 16:03

General

  • Target

    47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe

  • Size

    104KB

  • MD5

    10031182705b3d864db88ccbd1191ca7

  • SHA1

    2e8626da1bb8e5a57198a324196fbd64880dc124

  • SHA256

    47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe

  • SHA512

    fb9768b14bdf6bd65550f9f3ba97ce0cce3c1ec6323cd00ae309b502302141c6269778eaf3edef31e9c9392fc24d76aa453e9d40326c981a35ce1acb9c5ecb12

  • SSDEEP

    3072:uetDOSpgJremwXSAvNdH1w4IqeolDHXOMxiU:2Spgxem/4NbTIq9D3Vxi

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
    "C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
      "C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DRNLQ.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1836
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f
          4⤵
          • Adds Run key to start application
          PID:4136
      • C:\Users\Admin\AppData\Roaming\trys.exe
        "C:\Users\Admin\AppData\Roaming\trys.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:332
        • C:\Users\Admin\AppData\Roaming\trys.exe
          "C:\Users\Admin\AppData\Roaming\trys.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2756
        • C:\Users\Admin\AppData\Roaming\trys.exe
          "C:\Users\Admin\AppData\Roaming\trys.exe"
          4⤵
          • Executes dropped EXE
          PID:3132

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DRNLQ.bat

    Filesize

    135B

    MD5

    6dbb2090ff90500da05a027765cde190

    SHA1

    425b833d9d1df8d6df6e5a59f738058808271949

    SHA256

    71ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881

    SHA512

    7e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    d8e5f3c45fff8042e8a74ab45419e648

    SHA1

    5140a4e78ddbc7b4d8ee7a1ba1c3c725eae1544a

    SHA256

    78fd55add0baf14c4f040983144a4d3ada3ffd5762a362172cafac84b0ec3eea

    SHA512

    5ad1a5eeba054f3a213b9154b744c00c462c973337edd053e36db4c2257be1033d893046eca35a47c3d1938eadd7f1af86b5112ce2f414988d3d0b657511a796

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    d8e5f3c45fff8042e8a74ab45419e648

    SHA1

    5140a4e78ddbc7b4d8ee7a1ba1c3c725eae1544a

    SHA256

    78fd55add0baf14c4f040983144a4d3ada3ffd5762a362172cafac84b0ec3eea

    SHA512

    5ad1a5eeba054f3a213b9154b744c00c462c973337edd053e36db4c2257be1033d893046eca35a47c3d1938eadd7f1af86b5112ce2f414988d3d0b657511a796

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    d8e5f3c45fff8042e8a74ab45419e648

    SHA1

    5140a4e78ddbc7b4d8ee7a1ba1c3c725eae1544a

    SHA256

    78fd55add0baf14c4f040983144a4d3ada3ffd5762a362172cafac84b0ec3eea

    SHA512

    5ad1a5eeba054f3a213b9154b744c00c462c973337edd053e36db4c2257be1033d893046eca35a47c3d1938eadd7f1af86b5112ce2f414988d3d0b657511a796

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    d8e5f3c45fff8042e8a74ab45419e648

    SHA1

    5140a4e78ddbc7b4d8ee7a1ba1c3c725eae1544a

    SHA256

    78fd55add0baf14c4f040983144a4d3ada3ffd5762a362172cafac84b0ec3eea

    SHA512

    5ad1a5eeba054f3a213b9154b744c00c462c973337edd053e36db4c2257be1033d893046eca35a47c3d1938eadd7f1af86b5112ce2f414988d3d0b657511a796

  • memory/332-164-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/332-153-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/1244-144-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/1244-133-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/1244-132-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2756-172-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2756-174-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3132-173-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/3132-168-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/3132-159-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/3132-171-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/3132-170-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4408-137-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4408-167-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4408-139-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4408-140-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4408-143-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB