Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/10/2022, 03:24

General

  • Target

    5238fc6bf3af2fc3b88d102c4f4cf99d.exe

  • Size

    5.5MB

  • MD5

    5238fc6bf3af2fc3b88d102c4f4cf99d

  • SHA1

    7c53d7e2294b99d13987207e6649679239c1b7db

  • SHA256

    fdb421f4a654a5c34a0ac53fe5b8034076d294c846f6df5c645ca102b6f4caf0

  • SHA512

    15ced287df98da57549848983785925c18fadd2bd5033afe26c1b95a811f3f51bfd09da80ef8c829cb061d240cc21ef936d0105f72ca0afb7427b172026dfd96

  • SSDEEP

    98304:0kLbDnTP0AenE1XFbFqvb9/vJtkh7dAy9QdB4BC+4fo8os9YYHo9ty55lji:DbzTP0ZEdwbV50aB4hjYIjkn+

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe
    "C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Users\Admin\AppData\Local\Temp\is-VHSGR.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-VHSGR.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp" /SL5="$9007C,4926658,832512,C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe
        "C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe" /VERYSILENT
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp" /SL5="$B0046,4926658,832512,C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:628
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            5⤵
              PID:1388

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\is-9T5TS.tmp\valom.dll

      Filesize

      284KB

      MD5

      da1d7a4aa733808a325c1f391fcb929d

      SHA1

      d1c897aaf9dd98e485ea3ecae824df6c44a56b52

      SHA256

      04900720fee885508357a6149de6905cf9e077baaede0eb54301ec33c243e542

      SHA512

      9a58395b31441ab29e56688f488911c9dba50eaf9fbf03b6d012c648e5436f4643148a03a26aa14e5789af78ca4e0ac9c4de7c9981136517b356c69581d79682

    • C:\Users\Admin\AppData\Local\Temp\is-R675E.tmp\valom.dll

      Filesize

      284KB

      MD5

      da1d7a4aa733808a325c1f391fcb929d

      SHA1

      d1c897aaf9dd98e485ea3ecae824df6c44a56b52

      SHA256

      04900720fee885508357a6149de6905cf9e077baaede0eb54301ec33c243e542

      SHA512

      9a58395b31441ab29e56688f488911c9dba50eaf9fbf03b6d012c648e5436f4643148a03a26aa14e5789af78ca4e0ac9c4de7c9981136517b356c69581d79682

    • C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

      Filesize

      3.0MB

      MD5

      a2c2a94b03a9313cc500f34e8e888814

      SHA1

      7d9bb44259d6eca9e6d77dbf92919ea17271e418

      SHA256

      4c9c6946f0ef4762738534176978db1ad3b8b90ad4f247bc77fc389550f0fa3d

      SHA512

      d5fde5abf118d79c77e406cf33c8ab69d88ad1bfae5be953a6a211654ede90bccd0fc5ef67d566bc38b31889065dec26436a834f5ec1bde0b60cb91bcbbe336d

    • C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

      Filesize

      3.0MB

      MD5

      a2c2a94b03a9313cc500f34e8e888814

      SHA1

      7d9bb44259d6eca9e6d77dbf92919ea17271e418

      SHA256

      4c9c6946f0ef4762738534176978db1ad3b8b90ad4f247bc77fc389550f0fa3d

      SHA512

      d5fde5abf118d79c77e406cf33c8ab69d88ad1bfae5be953a6a211654ede90bccd0fc5ef67d566bc38b31889065dec26436a834f5ec1bde0b60cb91bcbbe336d

    • C:\Users\Admin\AppData\Local\Temp\is-VHSGR.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

      Filesize

      3.0MB

      MD5

      a2c2a94b03a9313cc500f34e8e888814

      SHA1

      7d9bb44259d6eca9e6d77dbf92919ea17271e418

      SHA256

      4c9c6946f0ef4762738534176978db1ad3b8b90ad4f247bc77fc389550f0fa3d

      SHA512

      d5fde5abf118d79c77e406cf33c8ab69d88ad1bfae5be953a6a211654ede90bccd0fc5ef67d566bc38b31889065dec26436a834f5ec1bde0b60cb91bcbbe336d

    • memory/628-149-0x00000000034D0000-0x00000000034F7000-memory.dmp

      Filesize

      156KB

    • memory/1388-146-0x0000000000B80000-0x0000000000BAC000-memory.dmp

      Filesize

      176KB

    • memory/1388-152-0x0000000000B80000-0x0000000000BAC000-memory.dmp

      Filesize

      176KB

    • memory/1388-150-0x0000000000B80000-0x0000000000BAC000-memory.dmp

      Filesize

      176KB

    • memory/1388-148-0x0000000000B80000-0x0000000000BAC000-memory.dmp

      Filesize

      176KB

    • memory/1388-147-0x0000000000B80000-0x0000000000BAC000-memory.dmp

      Filesize

      176KB

    • memory/1524-139-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

    • memory/1524-153-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

    • memory/4780-136-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

    • memory/4780-132-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

    • memory/4780-141-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB