Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    171s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 17:53

General

  • Target

    2906770839b2b7fd89e29f1a5f434ea66f09e61d28893e7812b1219f3289e6e5.exe

  • Size

    228KB

  • MD5

    830160e0fe467f38031bbf1d595eab40

  • SHA1

    6d850516aa58a42303001c3b926a1a61db0f097d

  • SHA256

    2906770839b2b7fd89e29f1a5f434ea66f09e61d28893e7812b1219f3289e6e5

  • SHA512

    2aeb4550739c29777e0e9e9cc52533938b2096e24dfef85c7e5abe53e53b298e3557f2690a7326bc7b0bd2a8b2c6548d1ea02a4f1d9aeafd812d5718d7de5fa0

  • SSDEEP

    6144:h+tFwzWQM2+OMcppIRW30d+h8wZ2Uf/T11cradKtvr1K/fObT/bGipKgJJeZ4cAe:KFw8OMcppIRW3M+hwUf/Z1craduvr1KZ

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2906770839b2b7fd89e29f1a5f434ea66f09e61d28893e7812b1219f3289e6e5.exe
    "C:\Users\Admin\AppData\Local\Temp\2906770839b2b7fd89e29f1a5f434ea66f09e61d28893e7812b1219f3289e6e5.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Users\Admin\svsuac.exe
      "C:\Users\Admin\svsuac.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3052

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\svsuac.exe

    Filesize

    228KB

    MD5

    94d083d7957be86834abc07acdff286f

    SHA1

    9257a80fe7a9f15d84a39d8bf3a3fe394e12aca4

    SHA256

    ac3e900ac3266d326e93ac97769f821f7b171f5762772be1f6005e520825c3b5

    SHA512

    2bb3d9a6eea0cf27a14108fb40855a6133b0bc31414ba84a41ef994add9fcc8be208823d4bf4583255af701c90a71442a3ebe99a00ea53a53c0e2971beb9a9b4

  • C:\Users\Admin\svsuac.exe

    Filesize

    228KB

    MD5

    94d083d7957be86834abc07acdff286f

    SHA1

    9257a80fe7a9f15d84a39d8bf3a3fe394e12aca4

    SHA256

    ac3e900ac3266d326e93ac97769f821f7b171f5762772be1f6005e520825c3b5

    SHA512

    2bb3d9a6eea0cf27a14108fb40855a6133b0bc31414ba84a41ef994add9fcc8be208823d4bf4583255af701c90a71442a3ebe99a00ea53a53c0e2971beb9a9b4