Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 13:28
Static task
static1
Behavioral task
behavioral1
Sample
Originals.lnk
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Originals.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
carcasses/full.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
carcasses/full.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
carcasses/imams.cmd
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
carcasses/imams.cmd
Resource
win10v2004-20220812-en
General
-
Target
Originals.lnk
-
Size
1KB
-
MD5
5b20c4ff2f74fb557d2b6dc004285231
-
SHA1
ed30fd4d056500060e467898c33f7d51e15a451d
-
SHA256
88cf6c638b912634731c94007ae470e5ca426ab2ef0d455335f4d17c8cd63e5b
-
SHA512
39caac70327860981172054ff7ea62623cc6037bdbde6de4568bfa9046136e382e8685c2c4fcdf6435168f2e6de9cf03b8dab09d9765265abe29e27bf8b3a52d
Malware Config
Extracted
qakbot
403.973
BB03
1666073717
190.199.99.171:993
41.69.192.245:443
167.58.254.85:443
206.1.172.1:443
5.163.177.234:443
134.35.0.103:443
105.96.221.136:443
41.101.100.7:443
186.177.93.18:2222
78.179.135.247:443
177.205.74.14:2222
102.47.218.41:443
102.156.149.226:443
41.250.48.206:443
41.107.58.251:443
187.198.16.39:443
193.201.187.64:443
41.102.134.89:443
102.159.77.134:995
105.159.49.123:995
197.200.236.69:443
154.247.82.36:443
37.37.80.2:3389
190.11.198.76:443
197.158.87.248:443
186.188.96.197:443
82.12.196.197:443
91.171.72.214:32100
72.88.245.71:443
84.220.94.231:443
151.251.50.117:443
105.154.56.232:995
41.107.116.19:443
159.192.204.135:443
177.152.65.142:443
176.45.35.243:443
104.233.202.195:443
149.126.159.254:443
181.56.171.3:995
200.93.11.28:2222
163.182.177.80:443
72.21.109.1:443
190.193.180.228:443
190.204.112.207:2222
41.97.56.102:443
206.1.208.223:2087
41.251.219.50:443
105.111.141.73:443
190.39.218.17:443
190.100.149.122:995
196.64.70.216:443
196.89.213.40:995
181.168.145.94:443
187.101.200.186:995
41.105.245.174:443
179.25.144.177:995
94.52.127.44:443
186.18.210.16:443
102.158.215.180:443
78.183.238.79:443
197.1.50.150:443
42.189.32.186:80
14.54.83.15:443
71.239.12.136:443
112.70.141.221:443
37.245.136.135:2222
88.232.10.69:443
41.98.250.65:443
82.205.9.34:443
196.64.239.75:443
37.8.68.1:443
197.1.248.244:443
197.2.139.7:443
79.45.134.162:22
182.183.211.163:995
154.246.14.94:443
144.86.17.168:443
182.185.29.69:995
160.177.47.116:6881
181.197.41.173:443
160.248.194.147:443
85.109.221.97:443
125.25.77.249:995
125.26.173.215:443
197.10.195.7:443
45.160.33.163:443
202.170.206.61:995
96.9.66.118:995
132.251.244.227:443
113.188.13.246:443
78.181.39.116:443
1.53.101.75:443
31.201.40.194:443
197.116.178.224:443
79.155.159.177:443
181.188.164.123:443
156.221.50.226:995
41.251.15.7:990
45.240.140.233:995
189.243.187.76:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4768 bbc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1528 regsvr32.exe 1528 regsvr32.exe 2032 wermgr.exe 2032 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1528 regsvr32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3640 wrote to memory of 1372 3640 cmd.exe 80 PID 3640 wrote to memory of 1372 3640 cmd.exe 80 PID 1372 wrote to memory of 4768 1372 cmd.exe 82 PID 1372 wrote to memory of 4768 1372 cmd.exe 82 PID 4768 wrote to memory of 1528 4768 bbc.exe 83 PID 4768 wrote to memory of 1528 4768 bbc.exe 83 PID 4768 wrote to memory of 1528 4768 bbc.exe 83 PID 1528 wrote to memory of 2032 1528 regsvr32.exe 90 PID 1528 wrote to memory of 2032 1528 regsvr32.exe 90 PID 1528 wrote to memory of 2032 1528 regsvr32.exe 90 PID 1528 wrote to memory of 2032 1528 regsvr32.exe 90 PID 1528 wrote to memory of 2032 1528 regsvr32.exe 90
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Originals.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c carcasses\imams.cmd re gs vr2⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\bbc.exeC:\Users\Admin\AppData\Local\Temp\bbc.exe carcasses\full.des3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\regsvr32.execarcasses\full.des4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5b0c2fa35d14a9fad919e99d9d75e1b9e
SHA18d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA256022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
SHA512a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022