Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    179s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 16:18

General

  • Target

    fe0e1078b6a694483ca79b9e25b1c82bbf11c3ad6b2bfb351a7774dee621dfe6.exe

  • Size

    164KB

  • MD5

    848f26f3c4591f19bede60fb8ec18332

  • SHA1

    22b3b976e314fdd9a8e05e7953346c740e31a7d8

  • SHA256

    fe0e1078b6a694483ca79b9e25b1c82bbf11c3ad6b2bfb351a7774dee621dfe6

  • SHA512

    74c3fe393f421ea2b1835191e2c21610b19fe9e538acd058f9bfebbc88c150ed26690dcfceaa227528a2b16bf08e5e2d7db033dc66964b41c631e8a13e455dde

  • SSDEEP

    3072:EsUaAUARtoYj3Bc8T828UAw1XiazCgaN8L2YAgt4oQZiE7H9b:BAxEaxc8Y28I1XiUq8sg/WH

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe0e1078b6a694483ca79b9e25b1c82bbf11c3ad6b2bfb351a7774dee621dfe6.exe
    "C:\Users\Admin\AppData\Local\Temp\fe0e1078b6a694483ca79b9e25b1c82bbf11c3ad6b2bfb351a7774dee621dfe6.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Users\Admin\ruamu.exe
      "C:\Users\Admin\ruamu.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3064

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\ruamu.exe

    Filesize

    164KB

    MD5

    aa622597334ba55d83e3336e30a324dc

    SHA1

    4e0e829a0169cef614f6e2d93e2d87fce0102229

    SHA256

    cdedcfd63635b466032add84ce8eefef7963737b35c41c5660a8f28ef44b23d8

    SHA512

    c95d754874feb87dff743ffca00a19cc02357bb49f7f5e1bee1960932796aa9f823d70c4db5359a80758ce0c9539b297e4f4b17a73d034921ebfe9a49ea4730e

  • C:\Users\Admin\ruamu.exe

    Filesize

    164KB

    MD5

    aa622597334ba55d83e3336e30a324dc

    SHA1

    4e0e829a0169cef614f6e2d93e2d87fce0102229

    SHA256

    cdedcfd63635b466032add84ce8eefef7963737b35c41c5660a8f28ef44b23d8

    SHA512

    c95d754874feb87dff743ffca00a19cc02357bb49f7f5e1bee1960932796aa9f823d70c4db5359a80758ce0c9539b297e4f4b17a73d034921ebfe9a49ea4730e

  • memory/3064-140-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/3064-142-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/4244-134-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/4244-141-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB