Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 16:25

General

  • Target

    b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe

  • Size

    540KB

  • MD5

    836889f1844bcc4b0d45c076dddc9e60

  • SHA1

    43f5db0eec96f26fcce318bdaa387cf97e608efe

  • SHA256

    b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a

  • SHA512

    f5182fca19a41b66e6f39cff41ca2c2434d6f2ae6152344e1b0864b3a098a6966c602ad9e8e813bd01f88dacd63bccd1b59bd4d859934ac16c3854390e1f54e5

  • SSDEEP

    12288:S9XdVx1+9jsFIezPTWuljbv95k92tVpg3:a/EjsFI0Fd9A2tVpo

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe
    "C:\Users\Admin\AppData\Local\Temp\b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DelTemp.bat" "
      2⤵
        PID:3168

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\DelTemp.bat

      Filesize

      187B

      MD5

      a937df466bb1cec01b78b85f7d750306

      SHA1

      a486c28051ace0e133a3210dea5de480ed931257

      SHA256

      cfbf50625c150e395e83ff255c37369909b9f5aadc573f7c09e7466206bc4a0a

      SHA512

      4b767925755688b42e6ccb5dfcf144351c8dc837da9b88bdb7b70790865cc3e9227cef9940d71fde2b8a6eacf50e0befcc72f085bea275424ee106ab1add8786