Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 01:23
Static task
static1
Behavioral task
behavioral1
Sample
Details.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Details.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
disallowable/lavatory.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
disallowable/lavatory.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
disallowable/leggings.cmd
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
disallowable/leggings.cmd
Resource
win10v2004-20220812-en
General
-
Target
Details.lnk
-
Size
1KB
-
MD5
f3c9192e747c7b3b0b861644ccf147ae
-
SHA1
37db46dc65a31dc8d0f2945ad9b1430b31d486e4
-
SHA256
d85957d2fc60de0204d94475a4ce85691e4de002e08f55809861a48f5ea58c14
-
SHA512
0692139ff36b3cdb2ef3971fea1e1bb57f83df8ba28bec6e947bba1cd1ed820b5fbd174f7a62a1fe118e6a168cccd2fc56db1cfc733f9afa397194ed0cdec1da
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2240 regsvr32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 regsvr32.exe 2976 regsvr32.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe 2168 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2976 regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 896 wrote to memory of 980 896 cmd.exe 83 PID 896 wrote to memory of 980 896 cmd.exe 83 PID 980 wrote to memory of 5020 980 cmd.exe 84 PID 980 wrote to memory of 5020 980 cmd.exe 84 PID 980 wrote to memory of 2240 980 cmd.exe 85 PID 980 wrote to memory of 2240 980 cmd.exe 85 PID 2240 wrote to memory of 2976 2240 regsvr32.exe 86 PID 2240 wrote to memory of 2976 2240 regsvr32.exe 86 PID 2240 wrote to memory of 2976 2240 regsvr32.exe 86 PID 2976 wrote to memory of 2168 2976 regsvr32.exe 89 PID 2976 wrote to memory of 2168 2976 regsvr32.exe 89 PID 2976 wrote to memory of 2168 2976 regsvr32.exe 89 PID 2976 wrote to memory of 2168 2976 regsvr32.exe 89 PID 2976 wrote to memory of 2168 2976 regsvr32.exe 89
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Details.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c disallowable\leggings.cmd r3 2.e xe2⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\system32\replace.exereplace C:\Windows\system32\regsvr32.exe C:\Users\Admin\AppData\Local\Temp /A3⤵PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\regsvr32.exeregsvr32.exe disallowable\lavatory.dat3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\regsvr32.exedisallowable\lavatory.dat4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2168
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5b0c2fa35d14a9fad919e99d9d75e1b9e
SHA18d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA256022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
SHA512a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022
-
Filesize
24KB
MD5b0c2fa35d14a9fad919e99d9d75e1b9e
SHA18d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA256022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
SHA512a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022