Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe
-
Size
272KB
-
MD5
9257f33eb4ad069b7d9c4e35b3cb8250
-
SHA1
29c499ea36931817985a51d3cea1d18398b35f5f
-
SHA256
331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6
-
SHA512
c6e8b0205e65e3222d5ac100d52f9a03c226f08e93cc34a2561791911192d1473c3310f191a6b011c3d9db19c6793b741ae6fb2a81e59eb3b4a0610ba88e8eff
-
SSDEEP
3072:w7NeVjaS56vRPchWO/1KxMh+2Alr/hVZK4I/3O8+ZYN4v3lHZZdDHsTmHd46HQnw:cNewtB8KxM9QlVyPO5l5XD1HdfwD
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0007000000022e6b-134.dat aspack_v212_v242 behavioral2/files/0x0007000000022e6b-135.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1900 IkfdGV.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation IkfdGV.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe IkfdGV.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe IkfdGV.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe IkfdGV.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe IkfdGV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE IkfdGV.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe IkfdGV.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE IkfdGV.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe IkfdGV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe IkfdGV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe IkfdGV.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe IkfdGV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe IkfdGV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe IkfdGV.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe IkfdGV.exe File opened for modification C:\Program Files\PingDismount.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe IkfdGV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe IkfdGV.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe IkfdGV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe IkfdGV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe IkfdGV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe IkfdGV.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4180 331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe 4180 331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4180 331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe 4180 331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4180 331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe 4180 331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4180 wrote to memory of 1900 4180 331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe 79 PID 4180 wrote to memory of 1900 4180 331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe 79 PID 4180 wrote to memory of 1900 4180 331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe 79 PID 1900 wrote to memory of 4672 1900 IkfdGV.exe 85 PID 1900 wrote to memory of 4672 1900 IkfdGV.exe 85 PID 1900 wrote to memory of 4672 1900 IkfdGV.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe"C:\Users\Admin\AppData\Local\Temp\331d356521c0d8d346b7fec9be374830543dca8404b2d371e8c73b1c5ef495c6.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\IkfdGV.exeC:\Users\Admin\AppData\Local\Temp\IkfdGV.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\359e79c9.bat" "3⤵PID:4672
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD547bc6599f55f3e0e07181d744b7e2a8c
SHA19dcd0ed0c3a435f2a5c958449e6d07719eadb878
SHA256ed78adfc912891474188639653b740dc8c0127b40b97486e90f38b1df17d4a98
SHA5126f81eb937e6565720a5862cf6d4091461c6fe680019e538181fdee81b988b4bccb26fdf3a9588f8c58c07eafe1f8eba6f944ac0119a7628c3e57a683ddbfa304
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e