Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
Resource
win10v2004-20220812-en
General
-
Target
fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
-
Size
196KB
-
MD5
75f7210d98f2f01390b04e086c1c55f0
-
SHA1
b7a67f2fe7a85ea449c6b6e3bbc2ca34e995d8f5
-
SHA256
fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1
-
SHA512
94120c149f80cd65e7d536f07843f8259a6d158902a9ad67c93e38d64fa98984e8b197bccc8f5cc1b7e703f8e6001dcf73c46dc45997b3b33f6fcb29861751c4
-
SSDEEP
1536:VXBYjfC24mFVsIgvo3X4iZpTha5VlA8ma7aoL8c/i:VX+0mFmIgvo4iZhha5rXaoL8c/i
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1920 jusched.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\3bd46b58\jusched.exe fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe File created C:\Program Files (x86)\3bd46b58\3bd46b58 fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe File created C:\Program Files (x86)\3bd46b58\info_a fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3700 wrote to memory of 1920 3700 fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe 83 PID 3700 wrote to memory of 1920 3700 fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe 83 PID 3700 wrote to memory of 1920 3700 fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe"C:\Users\Admin\AppData\Local\Temp\fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Program Files (x86)\3bd46b58\jusched.exe"C:\Program Files (x86)\3bd46b58\jusched.exe"2⤵
- Executes dropped EXE
PID:1920
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD5bff3d8f76e182194c4a2abf1aabba9f3
SHA107e5b604bb505a800b3e0ac16fee483b70595768
SHA2566bc8a4f93eaa1b3e7cfa696855bf6a852cf6555d694bc03e337261a27e58246f
SHA5120c5def3bb01ed166d4135190e131c27be4b6039987e269b6c3fca07677b3c637868397f207df631a098182a6bd3c795e6dd34541f82c5ecd6062441af0af7f50
-
Filesize
12B
MD5afff6a63be4f33f64f4d29b29fd90b26
SHA163b508ac2fee265b6e652a8f9752e00bb87791a5
SHA256c21f313c812c67133889ae2a43d7c68c7926b00a5fc69b1f18ddc2f2065a6abe
SHA51232bc55cb0fc6560ee8a955cbd9d63038839e4ec619f346e68cbab152b0d9adb9001600082c5e02fb3344d2c4f9c1139093b6bee33fe6d930acd1bfed3ad4beca
-
Filesize
196KB
MD56fbda9c1e6b3b1b75533a2bd1658486b
SHA100ab2eea7de77010e8ce8f1fdd55a0e9479dab42
SHA256d7ddd34691bd567f56e1e9fae13fbb1cdf41046e8696a033e1da736d52124a5d
SHA5122b61712ba240599d963ac14a446ac3619455b57dbbf8ef6ca6589c3a02b0878fd090660979ee358ed392370e01309be28aa876a7b183998b719e5b76323bbff0
-
Filesize
196KB
MD56fbda9c1e6b3b1b75533a2bd1658486b
SHA100ab2eea7de77010e8ce8f1fdd55a0e9479dab42
SHA256d7ddd34691bd567f56e1e9fae13fbb1cdf41046e8696a033e1da736d52124a5d
SHA5122b61712ba240599d963ac14a446ac3619455b57dbbf8ef6ca6589c3a02b0878fd090660979ee358ed392370e01309be28aa876a7b183998b719e5b76323bbff0