Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe
Resource
win10v2004-20220901-en
General
-
Target
f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe
-
Size
193KB
-
MD5
4b61bfb74b4518d0733aa550c6fc7f0b
-
SHA1
940e255e7f360235b33282e0b0a4aa600b9cd681
-
SHA256
f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4
-
SHA512
d0b87aba7796bc62dd4c3cb84bf66fb7feee1ad49b9f47241d4b216a78c074715121915d3e7113a3d2d3b9e5d0cec5d07d45841acc04b37027d5f8d91fa0346a
-
SSDEEP
3072:nbLpZuEskJoU4CqQ1LNALc9gWhQh22c4uSiDmXy3PnHbhEdILWoja4jbeRmotu:nbOOxBdNeczhQk4Til/nHF/jFjimH
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2264 nsA252.tmp 1760 UnRAR.exe 3064 01.exe 2888 02.exe -
resource yara_rule behavioral2/files/0x0002000000022dd9-137.dat upx behavioral2/files/0x0002000000022dd9-138.dat upx behavioral2/memory/1760-140-0x0000000000400000-0x0000000000442000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 4488 2888 WerFault.exe 87 1812 3064 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4584 wrote to memory of 2264 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe 83 PID 4584 wrote to memory of 2264 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe 83 PID 4584 wrote to memory of 2264 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe 83 PID 2264 wrote to memory of 1760 2264 nsA252.tmp 85 PID 2264 wrote to memory of 1760 2264 nsA252.tmp 85 PID 2264 wrote to memory of 1760 2264 nsA252.tmp 85 PID 4584 wrote to memory of 3064 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe 86 PID 4584 wrote to memory of 3064 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe 86 PID 4584 wrote to memory of 3064 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe 86 PID 4584 wrote to memory of 2888 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe 87 PID 4584 wrote to memory of 2888 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe 87 PID 4584 wrote to memory of 2888 4584 f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe"C:\Users\Admin\AppData\Local\Temp\f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\nsaA242.tmp\nsA252.tmp"C:\Users\Admin\AppData\Local\Temp\nsaA242.tmp\nsA252.tmp" "C:\Users\Admin\AppData\Local\Temp\UnRAR.exe" e -o+ -pqwaszx 1.rar2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\UnRAR.exe"C:\Users\Admin\AppData\Local\Temp\UnRAR.exe" e -o+ -pqwaszx 1.rar3⤵
- Executes dropped EXE
PID:1760
-
-
-
C:\Users\Admin\AppData\Local\Temp\01.exe01.exe2⤵
- Executes dropped EXE
PID:3064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 4243⤵
- Program crash
PID:1812
-
-
-
C:\Users\Admin\AppData\Local\Temp\02.exe02.exe2⤵
- Executes dropped EXE
PID:2888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 3323⤵
- Program crash
PID:4488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2888 -ip 28881⤵PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3064 -ip 30641⤵PID:3540
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD566050a0058410559f98b3d3ac9e2bd6d
SHA118b4dc220d44b271cbb98f7e352afc273d95b699
SHA256dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40
SHA5128e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5
-
Filesize
61KB
MD566050a0058410559f98b3d3ac9e2bd6d
SHA118b4dc220d44b271cbb98f7e352afc273d95b699
SHA256dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40
SHA5128e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5
-
Filesize
6KB
MD53c4eef3f3c3610800290619dfd66d551
SHA1c0f8229179366a2d43566d95da66347938c374ae
SHA256483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00
SHA512c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd
-
Filesize
6KB
MD53c4eef3f3c3610800290619dfd66d551
SHA1c0f8229179366a2d43566d95da66347938c374ae
SHA256483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00
SHA512c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd
-
Filesize
33KB
MD541d92ccb2fe2c0f5a646e659ddae6ed2
SHA1bcdb555a87271749c7844ae8e13846abd7e7b039
SHA2560485f52f3a00a1e1a540f108553e4aedf8bbb5c837a3533671774351b270ea3f
SHA51231c8c51e056f8774f52f2d32e2b27a404616603949462476d37f0d35b3b5234f2c472cadabead52bccda9c04b96d2da064ea0cba397e6ed6039536781e4c1e50
-
Filesize
90KB
MD5d87ddf597baf91e7d32b20c0b4d855da
SHA14e855b5c03e0a52d8057bc86b83a07f10d00e455
SHA256264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac
SHA512f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26
-
Filesize
90KB
MD5d87ddf597baf91e7d32b20c0b4d855da
SHA14e855b5c03e0a52d8057bc86b83a07f10d00e455
SHA256264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac
SHA512f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26
-
Filesize
6KB
MD52b81b005983d2147fd587f6a54e2480e
SHA1cb21d91fa43bec9b6948fdca4f312949e71beb9f
SHA256e2b3645086c5e0c75e3676db80fdb5d6a31e0f5bc7ee1689d077de1d02f46e7a
SHA512b436f636824291301543a3ecae879139bce22b9246cd01da4f1da65aa51122ce18feb53886eba398f51e991677c694ed244b0521a32d27be40c98523c0a845fb
-
Filesize
6KB
MD52b81b005983d2147fd587f6a54e2480e
SHA1cb21d91fa43bec9b6948fdca4f312949e71beb9f
SHA256e2b3645086c5e0c75e3676db80fdb5d6a31e0f5bc7ee1689d077de1d02f46e7a
SHA512b436f636824291301543a3ecae879139bce22b9246cd01da4f1da65aa51122ce18feb53886eba398f51e991677c694ed244b0521a32d27be40c98523c0a845fb
-
Filesize
6KB
MD503a1a9be1f1e72f926ec9161825eedd6
SHA1d0574bafc615168c021788d413a3a73d275c492d
SHA2568a8bce943b78093ecd86a42c203931ee625f445acf5cb5b705e3b7eaf29c7110
SHA5128d82e15ee109d2236a995990fdd0c9fb39c9d3c4dea1c063f0806314e7a9d09a112f4f09091c265adba9f86ec7a0977294cce112e20ffb2f8b3ad62ab3dac396