Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2022, 18:40
Behavioral task
behavioral1
Sample
7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe
-
Size
176KB
-
MD5
56ca8efd6d41dd310abc232365624d07
-
SHA1
706ec20c8303299217135d381ad3d0631f3aef52
-
SHA256
7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a
-
SHA512
e88b05ef3b8cbde54994d8000e28d069c5a24d6345cda6a6fd5f79e1702ed68fe6c4450c290bc9065cdcff3ca18b19e60e425688539a77c7712bc73bf150969b
-
SSDEEP
3072:O/Vr9auMqqDL2/xr3IdE8we0Avu5r++ygLIaaxvdy0X9v/7M7BC/FTqdVY77C37R:O/VYFqqDL68vdy0tv
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 63 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 120.241.130.92 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 117.89.178.151 Destination IP 120.241.130.92 Destination IP 117.89.178.151 -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\K: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\L: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\Q: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\S: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\Y: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\F: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\J: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\N: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\O: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\V: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\W: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\Z: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\A: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\E: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\H: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\I: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\M: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\T: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\G: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\P: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\R: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\U: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\X: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4760 wrote to memory of 1560 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 80 PID 4760 wrote to memory of 1560 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 80 PID 4760 wrote to memory of 1560 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 80 PID 4760 wrote to memory of 4508 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 82 PID 4760 wrote to memory of 4508 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 82 PID 4760 wrote to memory of 4508 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 82 PID 4760 wrote to memory of 4680 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 84 PID 4760 wrote to memory of 4680 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 84 PID 4760 wrote to memory of 4680 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 84 PID 4760 wrote to memory of 792 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 93 PID 4760 wrote to memory of 792 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 93 PID 4760 wrote to memory of 792 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 93 PID 4760 wrote to memory of 4284 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 95 PID 4760 wrote to memory of 4284 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 95 PID 4760 wrote to memory of 4284 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 95 PID 4760 wrote to memory of 3752 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 97 PID 4760 wrote to memory of 3752 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 97 PID 4760 wrote to memory of 3752 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 97 PID 4760 wrote to memory of 4460 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 99 PID 4760 wrote to memory of 4460 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 99 PID 4760 wrote to memory of 4460 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 99 PID 4760 wrote to memory of 4076 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 101 PID 4760 wrote to memory of 4076 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 101 PID 4760 wrote to memory of 4076 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 101 PID 4760 wrote to memory of 3120 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 103 PID 4760 wrote to memory of 3120 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 103 PID 4760 wrote to memory of 3120 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 103 PID 4760 wrote to memory of 3520 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 105 PID 4760 wrote to memory of 3520 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 105 PID 4760 wrote to memory of 3520 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 105 PID 4760 wrote to memory of 1320 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 107 PID 4760 wrote to memory of 1320 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 107 PID 4760 wrote to memory of 1320 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 107 PID 4760 wrote to memory of 3776 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 109 PID 4760 wrote to memory of 3776 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 109 PID 4760 wrote to memory of 3776 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 109 PID 4760 wrote to memory of 4192 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 111 PID 4760 wrote to memory of 4192 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 111 PID 4760 wrote to memory of 4192 4760 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe"C:\Users\Admin\AppData\Local\Temp\7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit a.dnspod.com2⤵PID:1560
-
-
C:\Windows\SysWOW64\nslookup.exenslookup bleepingcomputer.bit a.dnspod.com2⤵PID:4508
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit a.dnspod.com2⤵PID:4680
-
-
C:\Windows\SysWOW64\nslookup.exenslookup esetnod32.bit a.dnspod.com2⤵PID:792
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit a.dnspod.com2⤵PID:4284
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit a.dnspod.com2⤵PID:3752
-
-
C:\Windows\SysWOW64\nslookup.exenslookup bleepingcomputer.bit a.dnspod.com2⤵PID:4460
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit a.dnspod.com2⤵PID:4076
-
-
C:\Windows\SysWOW64\nslookup.exenslookup esetnod32.bit a.dnspod.com2⤵PID:3120
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit a.dnspod.com2⤵PID:3520
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit a.dnspod.com2⤵PID:1320
-
-
C:\Windows\SysWOW64\nslookup.exenslookup bleepingcomputer.bit a.dnspod.com2⤵PID:3776
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit a.dnspod.com2⤵PID:4192
-