Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    71s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2022, 02:56

General

  • Target

    6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe

  • Size

    456KB

  • MD5

    53c4f7882517eabc78d3ee22d897aa4e

  • SHA1

    c59e5a5b286eb15c22f1cf0975b11652f97c5ba9

  • SHA256

    6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c

  • SHA512

    47bef082df3e812f7e54e9b3236c915ffe093a679ae41c54946fe795e97489a027c38d1dc7a92ac18b86cbc2419fb5866b5e25dd17c47d90385996996bd78be5

  • SSDEEP

    12288:jEVXKpmokkif4JgTIoq43H2cE05nMx11DGkfb7i:jEtR8iAJgMe3H2cJCx1YOb7i

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 45 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe
    "C:\Users\Admin\AppData\Local\Temp\6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\Temp\6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe
      6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe
        C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3556
        • C:\Users\Admin\deehaa.exe
          "C:\Users\Admin\deehaa.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:1068
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del iAsD8zgo9sJlU4T4lK.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3524
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4892
      • C:\Users\Admin\txhost.exe
        C:\Users\Admin\txhost.exe
        3⤵
        • Executes dropped EXE
        PID:4192
      • C:\Users\Admin\uxhost.exe
        C:\Users\Admin\uxhost.exe
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of AdjustPrivilegeToken
        PID:1324

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\deehaa.exe

    Filesize

    156KB

    MD5

    dbc0a2f0d4b8e03ef8d44d56d580ed65

    SHA1

    feb2e62ef5e12ce1b3e7712d4c1bbf6518a4c70f

    SHA256

    45c3345d38ff8f0832786126ff4f94e26d7d415ce53f62aa5a75dc65a90a918d

    SHA512

    19f7476879bbdabf77ea2100e58c1bcb1d881536f090f3bf7e5c5a5f728c0da37ada0f6db46ede8876a675fb455364021dc23a2e17ad64361a3dbd9b70b2ab90

  • C:\Users\Admin\deehaa.exe

    Filesize

    156KB

    MD5

    dbc0a2f0d4b8e03ef8d44d56d580ed65

    SHA1

    feb2e62ef5e12ce1b3e7712d4c1bbf6518a4c70f

    SHA256

    45c3345d38ff8f0832786126ff4f94e26d7d415ce53f62aa5a75dc65a90a918d

    SHA512

    19f7476879bbdabf77ea2100e58c1bcb1d881536f090f3bf7e5c5a5f728c0da37ada0f6db46ede8876a675fb455364021dc23a2e17ad64361a3dbd9b70b2ab90

  • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • C:\Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • memory/1324-158-0x00000000008E0000-0x0000000000944000-memory.dmp

    Filesize

    400KB

  • memory/1324-159-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/1324-160-0x00000000008E0000-0x0000000000944000-memory.dmp

    Filesize

    400KB

  • memory/2592-137-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/2592-133-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/2592-135-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB