Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    64s
  • max time network
    68s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 13:18

General

  • Target

    14e0557e3d49fbfc37f71404d8b63cda0be9b309775c1b56db69129d75a07795.exe

  • Size

    456KB

  • MD5

    0f5a798c3eab0fb201a1fda5e5c7864a

  • SHA1

    cc1b718efd292d397bd079dc077514c2bee56ddc

  • SHA256

    14e0557e3d49fbfc37f71404d8b63cda0be9b309775c1b56db69129d75a07795

  • SHA512

    c0c42e2505d84788ab722f236f28e4354d340dfda9731f908cd2ec1c56d0fef6199b65bf8cdb7d5c274f5c7417f933dfb34bd314f37c741672fade2a29e0efd9

  • SSDEEP

    12288:jEVXKpmokYif4JgTIoq43H2cE05nMx11DGkfb7i:jEtRQiAJgMe3H2cJCx1YOb7i

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 41 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14e0557e3d49fbfc37f71404d8b63cda0be9b309775c1b56db69129d75a07795.exe
    "C:\Users\Admin\AppData\Local\Temp\14e0557e3d49fbfc37f71404d8b63cda0be9b309775c1b56db69129d75a07795.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Users\Admin\AppData\Local\Temp\14e0557e3d49fbfc37f71404d8b63cda0be9b309775c1b56db69129d75a07795.exe
      14e0557e3d49fbfc37f71404d8b63cda0be9b309775c1b56db69129d75a07795.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe
        C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Users\Admin\veebour.exe
          "C:\Users\Admin\veebour.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:3084
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del iAsD8zgo9sJlU4T4lK.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2316
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5104
      • C:\Users\Admin\txhost.exe
        C:\Users\Admin\txhost.exe
        3⤵
        • Executes dropped EXE
        PID:2264
      • C:\Users\Admin\uxhost.exe
        C:\Users\Admin\uxhost.exe
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of AdjustPrivilegeToken
        PID:4048

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • C:\Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • C:\Users\Admin\veebour.exe

    Filesize

    156KB

    MD5

    1bd2e36059c0da64b8e781c78819477e

    SHA1

    aefe85a288b23f2a00565fb6b733770ccfcf241f

    SHA256

    515b2040b42e8c02045fb67da593c7f9b44c4318b1e7003e0295344fa2984bcf

    SHA512

    ea420fef3f5f255dccad08277ea449495b99b4b643bd6da052668e899765e0434122a52db28a8b1a19357ed661c5a42dc551de2f22782b31a2f7c07d80208180

  • C:\Users\Admin\veebour.exe

    Filesize

    156KB

    MD5

    1bd2e36059c0da64b8e781c78819477e

    SHA1

    aefe85a288b23f2a00565fb6b733770ccfcf241f

    SHA256

    515b2040b42e8c02045fb67da593c7f9b44c4318b1e7003e0295344fa2984bcf

    SHA512

    ea420fef3f5f255dccad08277ea449495b99b4b643bd6da052668e899765e0434122a52db28a8b1a19357ed661c5a42dc551de2f22782b31a2f7c07d80208180

  • memory/3340-137-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/3340-135-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/3340-133-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/4048-158-0x00000000006E0000-0x0000000000744000-memory.dmp

    Filesize

    400KB

  • memory/4048-160-0x00000000006E0000-0x0000000000744000-memory.dmp

    Filesize

    400KB

  • memory/4048-159-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB