Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2022, 03:24
Static task
static1
Behavioral task
behavioral1
Sample
5238fc6bf3af2fc3b88d102c4f4cf99d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5238fc6bf3af2fc3b88d102c4f4cf99d.exe
Resource
win10v2004-20220901-en
General
-
Target
5238fc6bf3af2fc3b88d102c4f4cf99d.exe
-
Size
5.5MB
-
MD5
5238fc6bf3af2fc3b88d102c4f4cf99d
-
SHA1
7c53d7e2294b99d13987207e6649679239c1b7db
-
SHA256
fdb421f4a654a5c34a0ac53fe5b8034076d294c846f6df5c645ca102b6f4caf0
-
SHA512
15ced287df98da57549848983785925c18fadd2bd5033afe26c1b95a811f3f51bfd09da80ef8c829cb061d240cc21ef936d0105f72ca0afb7427b172026dfd96
-
SSDEEP
98304:0kLbDnTP0AenE1XFbFqvb9/vJtkh7dAy9QdB4BC+4fo8os9YYHo9ty55lji:DbzTP0ZEdwbV50aB4hjYIjkn+
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4880 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp -
Loads dropped DLL 2 IoCs
pid Process 4880 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 217.160.70.42 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 628 set thread context of 1388 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 85 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\PC_installer\unins000.dat 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp File created C:\Program Files (x86)\PC_installer\is-9TQJ0.tmp 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4780 wrote to memory of 4880 4780 5238fc6bf3af2fc3b88d102c4f4cf99d.exe 82 PID 4780 wrote to memory of 4880 4780 5238fc6bf3af2fc3b88d102c4f4cf99d.exe 82 PID 4780 wrote to memory of 4880 4780 5238fc6bf3af2fc3b88d102c4f4cf99d.exe 82 PID 4880 wrote to memory of 1524 4880 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 83 PID 4880 wrote to memory of 1524 4880 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 83 PID 4880 wrote to memory of 1524 4880 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 83 PID 1524 wrote to memory of 628 1524 5238fc6bf3af2fc3b88d102c4f4cf99d.exe 84 PID 1524 wrote to memory of 628 1524 5238fc6bf3af2fc3b88d102c4f4cf99d.exe 84 PID 1524 wrote to memory of 628 1524 5238fc6bf3af2fc3b88d102c4f4cf99d.exe 84 PID 628 wrote to memory of 1388 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 85 PID 628 wrote to memory of 1388 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 85 PID 628 wrote to memory of 1388 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 85 PID 628 wrote to memory of 1388 628 5238fc6bf3af2fc3b88d102c4f4cf99d.tmp 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe"C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\is-VHSGR.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp"C:\Users\Admin\AppData\Local\Temp\is-VHSGR.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp" /SL5="$9007C,4926658,832512,C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe"C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe" /VERYSILENT3⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp"C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp" /SL5="$B0046,4926658,832512,C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵PID:1388
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD5da1d7a4aa733808a325c1f391fcb929d
SHA1d1c897aaf9dd98e485ea3ecae824df6c44a56b52
SHA25604900720fee885508357a6149de6905cf9e077baaede0eb54301ec33c243e542
SHA5129a58395b31441ab29e56688f488911c9dba50eaf9fbf03b6d012c648e5436f4643148a03a26aa14e5789af78ca4e0ac9c4de7c9981136517b356c69581d79682
-
Filesize
284KB
MD5da1d7a4aa733808a325c1f391fcb929d
SHA1d1c897aaf9dd98e485ea3ecae824df6c44a56b52
SHA25604900720fee885508357a6149de6905cf9e077baaede0eb54301ec33c243e542
SHA5129a58395b31441ab29e56688f488911c9dba50eaf9fbf03b6d012c648e5436f4643148a03a26aa14e5789af78ca4e0ac9c4de7c9981136517b356c69581d79682
-
Filesize
3.0MB
MD5a2c2a94b03a9313cc500f34e8e888814
SHA17d9bb44259d6eca9e6d77dbf92919ea17271e418
SHA2564c9c6946f0ef4762738534176978db1ad3b8b90ad4f247bc77fc389550f0fa3d
SHA512d5fde5abf118d79c77e406cf33c8ab69d88ad1bfae5be953a6a211654ede90bccd0fc5ef67d566bc38b31889065dec26436a834f5ec1bde0b60cb91bcbbe336d
-
Filesize
3.0MB
MD5a2c2a94b03a9313cc500f34e8e888814
SHA17d9bb44259d6eca9e6d77dbf92919ea17271e418
SHA2564c9c6946f0ef4762738534176978db1ad3b8b90ad4f247bc77fc389550f0fa3d
SHA512d5fde5abf118d79c77e406cf33c8ab69d88ad1bfae5be953a6a211654ede90bccd0fc5ef67d566bc38b31889065dec26436a834f5ec1bde0b60cb91bcbbe336d
-
Filesize
3.0MB
MD5a2c2a94b03a9313cc500f34e8e888814
SHA17d9bb44259d6eca9e6d77dbf92919ea17271e418
SHA2564c9c6946f0ef4762738534176978db1ad3b8b90ad4f247bc77fc389550f0fa3d
SHA512d5fde5abf118d79c77e406cf33c8ab69d88ad1bfae5be953a6a211654ede90bccd0fc5ef67d566bc38b31889065dec26436a834f5ec1bde0b60cb91bcbbe336d