Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2022, 15:17

General

  • Target

    a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce.exe

  • Size

    456KB

  • MD5

    78ceaec5ce59fb0e606fa674c9894bfb

  • SHA1

    0948b0cecd5150d8be281e6a398a3ec52b90719d

  • SHA256

    a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce

  • SHA512

    69ecd76167595ac30999eef0a1ab83a3dc81fe32fb0492ba1ed5a2715bb52fe256f5e5fa7541b8e482f056730226d56537056ce5d4c7311678ec6d0dff6b4dd7

  • SSDEEP

    12288:jEVXKpmokdif4JgTIoq43H2cE05nMx11DGkfb7i:jEtRliAJgMe3H2cJCx1YOb7i

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 34 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce.exe
    "C:\Users\Admin\AppData\Local\Temp\a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce.exe
      a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe
        C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Users\Admin\lueniiq.exe
          "C:\Users\Admin\lueniiq.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2308
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del iAsD8zgo9sJlU4T4lK.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3396
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1968
      • C:\Users\Admin\txhost.exe
        C:\Users\Admin\txhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Users\Admin\txhost.exe
          txhost.exe
          4⤵
          • Executes dropped EXE
          PID:3852
      • C:\Users\Admin\uxhost.exe
        C:\Users\Admin\uxhost.exe
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of AdjustPrivilegeToken
        PID:3736

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • C:\Users\Admin\lueniiq.exe

    Filesize

    156KB

    MD5

    c43de7611cc8bcd467a3c635d66da4c7

    SHA1

    e0cd93418be1831f89590dc9c99a30e5d2efd36a

    SHA256

    2464e457232e11d85d9095ae8c417134a294e6d8cacbf3db9070679847c947e7

    SHA512

    0a2cbea128faea96f38243c1a0dbe51a874770eea2f6ce20d43f53d88fddc007925c10f23026c5ec07d3bea379f2daf11463d6846cacc97e29e89c1cfd4e3c9a

  • C:\Users\Admin\lueniiq.exe

    Filesize

    156KB

    MD5

    c43de7611cc8bcd467a3c635d66da4c7

    SHA1

    e0cd93418be1831f89590dc9c99a30e5d2efd36a

    SHA256

    2464e457232e11d85d9095ae8c417134a294e6d8cacbf3db9070679847c947e7

    SHA512

    0a2cbea128faea96f38243c1a0dbe51a874770eea2f6ce20d43f53d88fddc007925c10f23026c5ec07d3bea379f2daf11463d6846cacc97e29e89c1cfd4e3c9a

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • C:\Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • memory/1248-137-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1248-135-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1248-133-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/3736-162-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/3736-159-0x00000000020F0000-0x0000000002154000-memory.dmp

    Filesize

    400KB

  • memory/3736-160-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/3736-161-0x00000000020F0000-0x0000000002154000-memory.dmp

    Filesize

    400KB

  • memory/3736-158-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/3852-164-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3852-165-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3852-166-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3852-167-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3852-168-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3852-171-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB