Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe
Resource
win10v2004-20220812-en
General
-
Target
1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe
-
Size
102KB
-
MD5
6b0ec0eb49cc3e7847a3405be5302620
-
SHA1
07d7e33b67f569c5a8a509bd94eb6a4b83adc20a
-
SHA256
1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3
-
SHA512
84917550d459dd24737085e88972c239a6aa74075ad377c70269d43b63151b401d441a0cb4f47fcc626d3984d6c7b8dff238acda41831ac2977b920b921ec8bb
-
SSDEEP
1536:z2oWR72UygYnzuquApbYpwn0rplH5SGTKKolVPh9A0Rw3kcbKmgHj:zpWR72UygWYAeVH5z+KsV8ABlj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4744 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 3460 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4744 Trojan.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4908 wrote to memory of 4744 4908 1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe 83 PID 4908 wrote to memory of 4744 4908 1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe 83 PID 4908 wrote to memory of 4744 4908 1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe 83 PID 4744 wrote to memory of 3460 4744 Trojan.exe 84 PID 4744 wrote to memory of 3460 4744 Trojan.exe 84 PID 4744 wrote to memory of 3460 4744 Trojan.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe"C:\Users\Admin\AppData\Local\Temp\1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:3460
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD56b0ec0eb49cc3e7847a3405be5302620
SHA107d7e33b67f569c5a8a509bd94eb6a4b83adc20a
SHA2561b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3
SHA51284917550d459dd24737085e88972c239a6aa74075ad377c70269d43b63151b401d441a0cb4f47fcc626d3984d6c7b8dff238acda41831ac2977b920b921ec8bb
-
Filesize
102KB
MD56b0ec0eb49cc3e7847a3405be5302620
SHA107d7e33b67f569c5a8a509bd94eb6a4b83adc20a
SHA2561b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3
SHA51284917550d459dd24737085e88972c239a6aa74075ad377c70269d43b63151b401d441a0cb4f47fcc626d3984d6c7b8dff238acda41831ac2977b920b921ec8bb