Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 10:08

General

  • Target

    70a03eb6bf751f13adc54b2900e7280e9aab1a0a9d12c40f507904edb3b2063d.exe

  • Size

    216KB

  • MD5

    96fc7dd6f52c78f3f36cb0f8df20d0f6

  • SHA1

    5724424acde4d96e1b75805a70050af6d8ce6f30

  • SHA256

    70a03eb6bf751f13adc54b2900e7280e9aab1a0a9d12c40f507904edb3b2063d

  • SHA512

    66a2b2aa8eee763ec1c2998655e36021607947c56e4ae70f1377787527b9455fbaf56941e85604d65571c225d4792914738b1a824ffd8b547768d683af39419c

  • SSDEEP

    6144:wKTstP7aHad+biYTBGbk6o5xTgkoPXZVanOf78DxejdN1ehLiBE1o55WoaNORC/l:wKTstP7aHad+biT+xTgkcpVaOf7Sex/q

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70a03eb6bf751f13adc54b2900e7280e9aab1a0a9d12c40f507904edb3b2063d.exe
    "C:\Users\Admin\AppData\Local\Temp\70a03eb6bf751f13adc54b2900e7280e9aab1a0a9d12c40f507904edb3b2063d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\gzzor.exe
      "C:\Users\Admin\gzzor.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4332

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\gzzor.exe

    Filesize

    216KB

    MD5

    a5654c78045a76115038ce11416abc53

    SHA1

    a533777e0ab6ec8447fb5d2151c1d6ec956860a8

    SHA256

    3bd267f440f1fb0ad68741d3244195f64cfb5de22c27f76473a9582d3eea662f

    SHA512

    f406d87a4ff83eed350a0590356bd99b1d11c8daa2e82d1f206b7a76d67e33ad95e2adb9482c061834a778828f073a0d1070fcd2266ce94c31bd9085c1f742a8

  • C:\Users\Admin\gzzor.exe

    Filesize

    216KB

    MD5

    a5654c78045a76115038ce11416abc53

    SHA1

    a533777e0ab6ec8447fb5d2151c1d6ec956860a8

    SHA256

    3bd267f440f1fb0ad68741d3244195f64cfb5de22c27f76473a9582d3eea662f

    SHA512

    f406d87a4ff83eed350a0590356bd99b1d11c8daa2e82d1f206b7a76d67e33ad95e2adb9482c061834a778828f073a0d1070fcd2266ce94c31bd9085c1f742a8