Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2022, 01:33

General

  • Target

    c42d8de1b800b29d2cc92d6e2fb06885487dd59a6a96f10a64a1c94fe7749dd7.exe

  • Size

    104KB

  • MD5

    579205770c7c333dc43ea71889fb5378

  • SHA1

    8e3363e82f88cb394568f52c9353427b9c440660

  • SHA256

    c42d8de1b800b29d2cc92d6e2fb06885487dd59a6a96f10a64a1c94fe7749dd7

  • SHA512

    68bc8f13633ff663787ef659b82b960d36eafffbe82095f07bd8daef01fccc7748a9328c8de8073c0748df858c235fcb50cb1cb0a8799611958399b73054e1f1

  • SSDEEP

    1536:3n5ifEQHScK4msKerjwJ8AOsNNk2HJQNsM03i6EY5:35ifEQqRsKFvHKN/E5

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c42d8de1b800b29d2cc92d6e2fb06885487dd59a6a96f10a64a1c94fe7749dd7.exe
    "C:\Users\Admin\AppData\Local\Temp\c42d8de1b800b29d2cc92d6e2fb06885487dd59a6a96f10a64a1c94fe7749dd7.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\qtzeib.exe
      "C:\Users\Admin\qtzeib.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2332

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\qtzeib.exe

    Filesize

    104KB

    MD5

    cccc4fe0a70616487397d0f5470a3d39

    SHA1

    89ed1ec3b0220a5e16bed0654c9282caec73e717

    SHA256

    dfa067908613e5847a71a1032a220e6afd82c6c337e86ecca507487866f29bf0

    SHA512

    240c9199af5210c3d0905a02d417b675defedb99b2a2434fdc7f05d12906029b5d037e3a3f06bb9f402d7fb7a85acbe66e98aeb7dfe4636047d521cd675534c6

  • C:\Users\Admin\qtzeib.exe

    Filesize

    104KB

    MD5

    cccc4fe0a70616487397d0f5470a3d39

    SHA1

    89ed1ec3b0220a5e16bed0654c9282caec73e717

    SHA256

    dfa067908613e5847a71a1032a220e6afd82c6c337e86ecca507487866f29bf0

    SHA512

    240c9199af5210c3d0905a02d417b675defedb99b2a2434fdc7f05d12906029b5d037e3a3f06bb9f402d7fb7a85acbe66e98aeb7dfe4636047d521cd675534c6