Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 20:19

General

  • Target

    d35ad5730630d218f4269d27d340a508907d621802d62817ea765976a14722f0.exe

  • Size

    581KB

  • MD5

    83a81d664d5ee61ab5f33030f4df24e7

  • SHA1

    a638555e23ad69f4a211b66ebd48e1d7ea6af88d

  • SHA256

    d35ad5730630d218f4269d27d340a508907d621802d62817ea765976a14722f0

  • SHA512

    94e32b8c484a4695e1c9102b311ae53ae35061e23ec1775dc2c1dadaec18d4ec4156a68095504bba72f537fe678e57ed4d2782535d3e26a496bdbdb7a2d4160c

  • SSDEEP

    12288:uoMDtCi7NFlZnNqZ9xGrLpZ0ZHEqtgb0Ut:ufplNFgxG5eZngb0C

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d35ad5730630d218f4269d27d340a508907d621802d62817ea765976a14722f0.exe
    "C:\Users\Admin\AppData\Local\Temp\d35ad5730630d218f4269d27d340a508907d621802d62817ea765976a14722f0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4100
    • C:\Users\Admin\AppData\Local\Temp\nbfile0.exe
      C:\Users\Admin\AppData\Local\Temp\nbfile0.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.97199.com/install2/?sl3
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4380 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3396
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\nbfile0.exe
        3⤵
          PID:4704
      • C:\Users\Admin\AppData\Local\Temp\nbfile1.exe
        C:\Users\Admin\AppData\Local\Temp\nbfile1.exe
        2⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"
          3⤵
            PID:1808
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\1.vbs"
            3⤵
              PID:4204

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          a66314123c8c72372bcb8583a5400a95

          SHA1

          fc3e45060463c37775da0bd4a8920296d222753d

          SHA256

          657c92d95798fc5dad4272f3d6d71776737ac0bcdce4ac6864ca5532f2ccf34d

          SHA512

          d9f5c243b04d7b3fbbcb37c68c583db672390644500cfa4d58280048d9fde52c668fd67e84ecd6ace20b2813eefb756627adbd04a6f19719f6e907aa3fffe4f1

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          434B

          MD5

          4f0d531c3c5f30f73055379c6ad64f59

          SHA1

          dd1622488ecc4dc041e7bb5b7a282067aab88183

          SHA256

          b666b8daaffbaee6fe1801ffbf7246ef17a91ac84883b9a09362e496736d08da

          SHA512

          67011544ea03925733794b484388573d094e3efe32a5e55368d19635c49a82483febf44bc2c39bf9be48ecfe30937c6c01aa81d16f15a6475c472b7f5eebcdb3

        • C:\Users\Admin\AppData\Local\Temp\nbfile0.exe

          Filesize

          467KB

          MD5

          74869a0346ab36bbba85022612505121

          SHA1

          2cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a

          SHA256

          6de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a

          SHA512

          723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5

        • C:\Users\Admin\AppData\Local\Temp\nbfile0.exe

          Filesize

          467KB

          MD5

          74869a0346ab36bbba85022612505121

          SHA1

          2cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a

          SHA256

          6de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a

          SHA512

          723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5

        • C:\Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • C:\Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • C:\newsetup.vbs

          Filesize

          651B

          MD5

          4736e7158c27f244482f5a614b9dbdae

          SHA1

          d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9

          SHA256

          b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc

          SHA512

          cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824

        • memory/1056-137-0x0000000000400000-0x000000000048A000-memory.dmp

          Filesize

          552KB

        • memory/1056-139-0x0000000000400000-0x000000000048A000-memory.dmp

          Filesize

          552KB