Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
20/10/2022, 07:32 UTC
General
-
Target
262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe
-
Size
52.5MB
-
MD5
c9d598317a092e5c199544be6b3800ce
-
SHA1
0d1cb3659420e75c1312031ac7475c70b19af3a9
-
SHA256
262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0
-
SHA512
cfd757095fcb47a6b4d289ce8f012e6565499bd204fb22473131fd7b386af4e508f577b4ab6f1f3624701509a3e79ea67d9345950ea1326c1d514d7efd8be00d
-
SSDEEP
786432:Dypsj8x7vWWYvnnT05vYZWOoxLDDB3H697dJg6SnfdcxNwbxOI6sQ2Z0vupW:qsjSWWinTwvZxf93H697Q6s8NXFt2qwW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe"C:\Users\Admin\AppData\Local\Temp\262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:662050 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-929662420-1054238289-2961194603-1000"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
- No results found
-
104.80.229.204:443 -
51.104.15.252:443 -
87.248.202.1:80
-
87.248.202.1:80
-
67.24.33.254:80
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
566KB
MD53fe7c92dba5c9240b4ab0d6a87e6166a
SHA17980d7dffc073515b621834246dda33ab00c308d
SHA256a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258
SHA512bd2c87b2d02b80b90f744a101bbb9294b1d90650a338be725028e6649e46a759fa72032e80ffe911ae82b005b4d2394960e7b73ce7ad8fe3a70e8a47d2a7c98d
-
Filesize
566KB
MD53fe7c92dba5c9240b4ab0d6a87e6166a
SHA17980d7dffc073515b621834246dda33ab00c308d
SHA256a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258
SHA512bd2c87b2d02b80b90f744a101bbb9294b1d90650a338be725028e6649e46a759fa72032e80ffe911ae82b005b4d2394960e7b73ce7ad8fe3a70e8a47d2a7c98d
-
Filesize
1.5MB
-
Filesize
1.5MB