Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 02:00
Behavioral task
behavioral1
Sample
d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe
Resource
win10v2004-20220812-en
General
-
Target
d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe
-
Size
461KB
-
MD5
a33492180a8cb4a75de5f1175d00b860
-
SHA1
52263f9358bf64879f8659b4e8fbd8b2c210ac4d
-
SHA256
d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d
-
SHA512
642b74a5b225cbc526bbb6332decf4475b1aaa427f325da1db2969284f7ab3bb3f8d17682e60ef03fc682da868601cb4410232d4012f82ef193534cda864f74d
-
SSDEEP
6144:iv27jyGy1/pEli1TQXG3QsE0VdQTQRwvwjvaIy7SeAefefUsDB:6/Fpl1UXGRVpw4jyIy2eAefeZN
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4604-132-0x0000000000400000-0x0000000000471000-memory.dmp upx behavioral2/memory/4604-133-0x0000000000400000-0x0000000000471000-memory.dmp upx -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\B: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\I: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\J: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\M: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\R: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\S: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\H: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\U: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\Z: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\W: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\Y: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\A: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\F: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\L: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\P: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\Q: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\V: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\E: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\G: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\K: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\N: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\O: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened (read-only) \??\X: d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened for modification C:\autorun.inf d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\NetInfo.exe d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe File opened for modification C:\Windows\SysWOW64\NetInfo.exe d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4604 d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe 4604 d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe"C:\Users\Admin\AppData\Local\Temp\d606ff9e7342727bfa807b1e2ee037c4e170cf284c45fe12b5de2d9022b81f2d.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4604