Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    63s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2022, 21:20

General

  • Target

    de9d871da2ae7c673be8b2c678df1393b636a5687f1325a5043eea27aad2d58d.exe

  • Size

    53KB

  • MD5

    e8189ad6682644db5c43b760c4e7cf14

  • SHA1

    d39ac6b75605b82a09211b4d9734563d423be3d3

  • SHA256

    de9d871da2ae7c673be8b2c678df1393b636a5687f1325a5043eea27aad2d58d

  • SHA512

    85a4f4dfea22b210f7cc1cad7ce338ee82bb130326e6489d3d0b840d17c141d76d4ce7d380aa09276cf239d4d9cde09d58a2fb7ebb2c27728d0cfdd7fb5d7fb7

  • SSDEEP

    768:wV/Pp4hAJdmJ1z+W04MzkTkEg3E1ysh3e5tHuRRFxcoA9To6:wV/AAJdi1zEPoTS3E1yshODHu4oAH

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de9d871da2ae7c673be8b2c678df1393b636a5687f1325a5043eea27aad2d58d.exe
    "C:\Users\Admin\AppData\Local\Temp\de9d871da2ae7c673be8b2c678df1393b636a5687f1325a5043eea27aad2d58d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Users\Admin\AppData\Local\Temp\weyjba.exe
      "C:\Users\Admin\AppData\Local\Temp\weyjba.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Modifies system certificate store
      PID:1944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\weyjba.exe

    Filesize

    53KB

    MD5

    444da60233eba6afb8e2f7160f6efb2c

    SHA1

    028365ecf0e1bb026ed799f37c5c4613b9d6cfe1

    SHA256

    a0f6b72cfa1e58f7178e81de4612e25d5c088491b3fa09854911bf04cbd3f70c

    SHA512

    22cdd978df44b801753f54e48198b908980d791f915d5f749f9180fc7709b7d0eac463a3c680dbde5d33a6cddc0444a725d3a9a0d575f379c8196ad125639720

  • C:\Users\Admin\AppData\Local\Temp\weyjba.exe

    Filesize

    53KB

    MD5

    444da60233eba6afb8e2f7160f6efb2c

    SHA1

    028365ecf0e1bb026ed799f37c5c4613b9d6cfe1

    SHA256

    a0f6b72cfa1e58f7178e81de4612e25d5c088491b3fa09854911bf04cbd3f70c

    SHA512

    22cdd978df44b801753f54e48198b908980d791f915d5f749f9180fc7709b7d0eac463a3c680dbde5d33a6cddc0444a725d3a9a0d575f379c8196ad125639720

  • memory/1944-140-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1944-141-0x0000000000570000-0x0000000000576000-memory.dmp

    Filesize

    24KB

  • memory/1944-142-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/5096-132-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/5096-133-0x0000000002220000-0x0000000002226000-memory.dmp

    Filesize

    24KB

  • memory/5096-134-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/5096-138-0x0000000002220000-0x0000000002226000-memory.dmp

    Filesize

    24KB