Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 20:08

General

  • Target

    d0a2cd7178138c2a20b505ea75957f8bcad9b768701a56f3e611f3fdc67aca1f.exe

  • Size

    104KB

  • MD5

    4ddf295a86e5dbf0cac5151960f971bc

  • SHA1

    640c97619f38e619e6eb77f4c5c7daeb8341fd3e

  • SHA256

    d0a2cd7178138c2a20b505ea75957f8bcad9b768701a56f3e611f3fdc67aca1f

  • SHA512

    f3443cf4d61fc84195fdbc5a9b5e77f22bfc1465a0ded02b2ea077d04bc0c4c90c8d7f8f908e4320d5d1e53d91c2c2d8f4cae4280d4f4bb3f02b662646c33e5b

  • SSDEEP

    1536:waLRvx+uTs+HBchhQKNIqpOcQv0sTEFSocwB+XjLlm:zK+eiKNZJQv0sToB+3s

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0a2cd7178138c2a20b505ea75957f8bcad9b768701a56f3e611f3fdc67aca1f.exe
    "C:\Users\Admin\AppData\Local\Temp\d0a2cd7178138c2a20b505ea75957f8bcad9b768701a56f3e611f3fdc67aca1f.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\cuhoq.exe
      "C:\Users\Admin\cuhoq.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4576

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\cuhoq.exe

    Filesize

    104KB

    MD5

    ea8362f45d4da115d18e7b89e5d3a248

    SHA1

    b93cd751c795e282b41cde2a8d8af3724e6e8a16

    SHA256

    879bf252ea233ebe14625af48f82b982e3c28821ca12205ebbeb43583bce8226

    SHA512

    3328c3f8c7404198feb72d138147f159f2d402a794e3348d745ed7bbad445b7e89a739b58dee86711ecbf315967a5de66c71c2305e4f415f2f177e0920273153

  • C:\Users\Admin\cuhoq.exe

    Filesize

    104KB

    MD5

    ea8362f45d4da115d18e7b89e5d3a248

    SHA1

    b93cd751c795e282b41cde2a8d8af3724e6e8a16

    SHA256

    879bf252ea233ebe14625af48f82b982e3c28821ca12205ebbeb43583bce8226

    SHA512

    3328c3f8c7404198feb72d138147f159f2d402a794e3348d745ed7bbad445b7e89a739b58dee86711ecbf315967a5de66c71c2305e4f415f2f177e0920273153