Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 02:09

General

  • Target

    fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe

  • Size

    196KB

  • MD5

    75f7210d98f2f01390b04e086c1c55f0

  • SHA1

    b7a67f2fe7a85ea449c6b6e3bbc2ca34e995d8f5

  • SHA256

    fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1

  • SHA512

    94120c149f80cd65e7d536f07843f8259a6d158902a9ad67c93e38d64fa98984e8b197bccc8f5cc1b7e703f8e6001dcf73c46dc45997b3b33f6fcb29861751c4

  • SSDEEP

    1536:VXBYjfC24mFVsIgvo3X4iZpTha5VlA8ma7aoL8c/i:VX+0mFmIgvo4iZhha5rXaoL8c/i

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
    "C:\Users\Admin\AppData\Local\Temp\fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\Program Files (x86)\3bd46b58\jusched.exe
      "C:\Program Files (x86)\3bd46b58\jusched.exe"
      2⤵
      • Executes dropped EXE
      PID:1920

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\3bd46b58\3bd46b58

    Filesize

    17B

    MD5

    bff3d8f76e182194c4a2abf1aabba9f3

    SHA1

    07e5b604bb505a800b3e0ac16fee483b70595768

    SHA256

    6bc8a4f93eaa1b3e7cfa696855bf6a852cf6555d694bc03e337261a27e58246f

    SHA512

    0c5def3bb01ed166d4135190e131c27be4b6039987e269b6c3fca07677b3c637868397f207df631a098182a6bd3c795e6dd34541f82c5ecd6062441af0af7f50

  • C:\Program Files (x86)\3bd46b58\info_a

    Filesize

    12B

    MD5

    afff6a63be4f33f64f4d29b29fd90b26

    SHA1

    63b508ac2fee265b6e652a8f9752e00bb87791a5

    SHA256

    c21f313c812c67133889ae2a43d7c68c7926b00a5fc69b1f18ddc2f2065a6abe

    SHA512

    32bc55cb0fc6560ee8a955cbd9d63038839e4ec619f346e68cbab152b0d9adb9001600082c5e02fb3344d2c4f9c1139093b6bee33fe6d930acd1bfed3ad4beca

  • C:\Program Files (x86)\3bd46b58\jusched.exe

    Filesize

    196KB

    MD5

    6fbda9c1e6b3b1b75533a2bd1658486b

    SHA1

    00ab2eea7de77010e8ce8f1fdd55a0e9479dab42

    SHA256

    d7ddd34691bd567f56e1e9fae13fbb1cdf41046e8696a033e1da736d52124a5d

    SHA512

    2b61712ba240599d963ac14a446ac3619455b57dbbf8ef6ca6589c3a02b0878fd090660979ee358ed392370e01309be28aa876a7b183998b719e5b76323bbff0

  • C:\Program Files (x86)\3bd46b58\jusched.exe

    Filesize

    196KB

    MD5

    6fbda9c1e6b3b1b75533a2bd1658486b

    SHA1

    00ab2eea7de77010e8ce8f1fdd55a0e9479dab42

    SHA256

    d7ddd34691bd567f56e1e9fae13fbb1cdf41046e8696a033e1da736d52124a5d

    SHA512

    2b61712ba240599d963ac14a446ac3619455b57dbbf8ef6ca6589c3a02b0878fd090660979ee358ed392370e01309be28aa876a7b183998b719e5b76323bbff0