Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 16:03
Behavioral task
behavioral1
Sample
47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
Resource
win10v2004-20220812-en
General
-
Target
47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
-
Size
104KB
-
MD5
10031182705b3d864db88ccbd1191ca7
-
SHA1
2e8626da1bb8e5a57198a324196fbd64880dc124
-
SHA256
47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe
-
SHA512
fb9768b14bdf6bd65550f9f3ba97ce0cce3c1ec6323cd00ae309b502302141c6269778eaf3edef31e9c9392fc24d76aa453e9d40326c981a35ce1acb9c5ecb12
-
SSDEEP
3072:uetDOSpgJremwXSAvNdH1w4IqeolDHXOMxiU:2Spgxem/4NbTIq9D3Vxi
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 332 trys.exe 2756 trys.exe 3132 trys.exe -
resource yara_rule behavioral2/memory/1244-132-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/1244-133-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4408-137-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4408-139-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4408-140-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4408-143-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1244-144-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/files/0x000a000000022df8-150.dat upx behavioral2/files/0x000a000000022df8-149.dat upx behavioral2/memory/332-153-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/files/0x000a000000022df8-156.dat upx behavioral2/memory/3132-159-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000a000000022df8-161.dat upx behavioral2/memory/332-164-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4408-167-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3132-168-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3132-170-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3132-171-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2756-172-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3132-173-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2756-174-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Users\\Admin\\AppData\\Roaming\\trys.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1244 set thread context of 4408 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 83 PID 332 set thread context of 2756 332 trys.exe 89 PID 332 set thread context of 3132 332 trys.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe Token: SeDebugPrivilege 2756 trys.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 4408 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 332 trys.exe 2756 trys.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1244 wrote to memory of 4408 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 83 PID 1244 wrote to memory of 4408 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 83 PID 1244 wrote to memory of 4408 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 83 PID 1244 wrote to memory of 4408 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 83 PID 1244 wrote to memory of 4408 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 83 PID 1244 wrote to memory of 4408 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 83 PID 1244 wrote to memory of 4408 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 83 PID 1244 wrote to memory of 4408 1244 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 83 PID 4408 wrote to memory of 1836 4408 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 84 PID 4408 wrote to memory of 1836 4408 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 84 PID 4408 wrote to memory of 1836 4408 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 84 PID 1836 wrote to memory of 4136 1836 cmd.exe 87 PID 1836 wrote to memory of 4136 1836 cmd.exe 87 PID 1836 wrote to memory of 4136 1836 cmd.exe 87 PID 4408 wrote to memory of 332 4408 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 88 PID 4408 wrote to memory of 332 4408 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 88 PID 4408 wrote to memory of 332 4408 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 88 PID 332 wrote to memory of 2756 332 trys.exe 89 PID 332 wrote to memory of 2756 332 trys.exe 89 PID 332 wrote to memory of 2756 332 trys.exe 89 PID 332 wrote to memory of 2756 332 trys.exe 89 PID 332 wrote to memory of 2756 332 trys.exe 89 PID 332 wrote to memory of 2756 332 trys.exe 89 PID 332 wrote to memory of 2756 332 trys.exe 89 PID 332 wrote to memory of 2756 332 trys.exe 89 PID 332 wrote to memory of 3132 332 trys.exe 90 PID 332 wrote to memory of 3132 332 trys.exe 90 PID 332 wrote to memory of 3132 332 trys.exe 90 PID 332 wrote to memory of 3132 332 trys.exe 90 PID 332 wrote to memory of 3132 332 trys.exe 90 PID 332 wrote to memory of 3132 332 trys.exe 90 PID 332 wrote to memory of 3132 332 trys.exe 90 PID 332 wrote to memory of 3132 332 trys.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DRNLQ.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f4⤵
- Adds Run key to start application
PID:4136
-
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2756
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"4⤵
- Executes dropped EXE
PID:3132
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD56dbb2090ff90500da05a027765cde190
SHA1425b833d9d1df8d6df6e5a59f738058808271949
SHA25671ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881
SHA5127e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3
-
Filesize
104KB
MD5d8e5f3c45fff8042e8a74ab45419e648
SHA15140a4e78ddbc7b4d8ee7a1ba1c3c725eae1544a
SHA25678fd55add0baf14c4f040983144a4d3ada3ffd5762a362172cafac84b0ec3eea
SHA5125ad1a5eeba054f3a213b9154b744c00c462c973337edd053e36db4c2257be1033d893046eca35a47c3d1938eadd7f1af86b5112ce2f414988d3d0b657511a796
-
Filesize
104KB
MD5d8e5f3c45fff8042e8a74ab45419e648
SHA15140a4e78ddbc7b4d8ee7a1ba1c3c725eae1544a
SHA25678fd55add0baf14c4f040983144a4d3ada3ffd5762a362172cafac84b0ec3eea
SHA5125ad1a5eeba054f3a213b9154b744c00c462c973337edd053e36db4c2257be1033d893046eca35a47c3d1938eadd7f1af86b5112ce2f414988d3d0b657511a796
-
Filesize
104KB
MD5d8e5f3c45fff8042e8a74ab45419e648
SHA15140a4e78ddbc7b4d8ee7a1ba1c3c725eae1544a
SHA25678fd55add0baf14c4f040983144a4d3ada3ffd5762a362172cafac84b0ec3eea
SHA5125ad1a5eeba054f3a213b9154b744c00c462c973337edd053e36db4c2257be1033d893046eca35a47c3d1938eadd7f1af86b5112ce2f414988d3d0b657511a796
-
Filesize
104KB
MD5d8e5f3c45fff8042e8a74ab45419e648
SHA15140a4e78ddbc7b4d8ee7a1ba1c3c725eae1544a
SHA25678fd55add0baf14c4f040983144a4d3ada3ffd5762a362172cafac84b0ec3eea
SHA5125ad1a5eeba054f3a213b9154b744c00c462c973337edd053e36db4c2257be1033d893046eca35a47c3d1938eadd7f1af86b5112ce2f414988d3d0b657511a796