Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2022, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe
-
Size
116KB
-
MD5
76c07e937622b4e5303ed5cfc1f0e580
-
SHA1
44721da1b241732e8474bbeca59e31c18e480c94
-
SHA256
90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d
-
SHA512
432653989d94bff9164f65a7adf62502a8b7a4ad2766bfcb9f5d617bef2c523d5778c4efff23c7a822707d5180067549c8b968c748f320d4d8dc966e4ca492a0
-
SSDEEP
3072:7wN6ym4zxz3jWzpDuzUjDzGDxziDbbSbUbNb3bhbwbdsaXCAyZK/zzazhACuzz+d:0kvssaXCkzzazhACuzz+cp0
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4844 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4844 tasklist.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2120 wrote to memory of 4112 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 81 PID 2120 wrote to memory of 4112 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 81 PID 2120 wrote to memory of 4112 2120 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 81 PID 4112 wrote to memory of 4844 4112 cmd.exe 83 PID 4112 wrote to memory of 4844 4112 cmd.exe 83 PID 4112 wrote to memory of 4844 4112 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe"C:\Users\Admin\AppData\Local\Temp\90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 90d13ac02c84c6e518a96d480874999a692⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-