Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
19/10/2022, 23:06
General
-
Target
3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
-
Size
408KB
-
MD5
a0eb151575bc500d6d818371fdb964ef
-
SHA1
93208d5b4648fdf774bc1d6a0c856892fa3cd292
-
SHA256
3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46
-
SHA512
663d0b9d81d922d37b9ed8d0d34bf079b9583f7ad60f61c0d53e0ae4144e4295a51d1e3d7a061c698955198d1c54b743c15eea23dcac764035333babd928703f
-
SSDEEP
12288:eumIwGaTYJDdSAWdFVv5gZKTe1XJiot/ro5d:3zwdUZdSAWZv5cX1t8P
Malware Config
Signatures
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe"C:\Users\Admin\AppData\Local\Temp\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe"C:\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$WindowsXp.bat2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5a0eb151575bc500d6d818371fdb964ef
SHA193208d5b4648fdf774bc1d6a0c856892fa3cd292
SHA2563ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46
SHA512663d0b9d81d922d37b9ed8d0d34bf079b9583f7ad60f61c0d53e0ae4144e4295a51d1e3d7a061c698955198d1c54b743c15eea23dcac764035333babd928703f
-
Filesize
408KB
MD5a0eb151575bc500d6d818371fdb964ef
SHA193208d5b4648fdf774bc1d6a0c856892fa3cd292
SHA2563ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46
SHA512663d0b9d81d922d37b9ed8d0d34bf079b9583f7ad60f61c0d53e0ae4144e4295a51d1e3d7a061c698955198d1c54b743c15eea23dcac764035333babd928703f
-
Filesize
297B
MD532647e935bafd65f743663ad27d36899
SHA121502e4bfd250b417f239d92ffa47b68dd9f28d6
SHA256f76429464e789d495a51fccd8c443719d6315c25c951220078c36515b8d7710e
SHA5128c56d2f454b6e038795a7d66284d576b4273ce285fca370cdae3de4744368e6303f36689f1b85fef5d6ca1cd46ed82537b581cc5af0ab16aea7344a8491ce8d1
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB