Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 13:41

General

  • Target

    778dc5f402ea7e860c9e7dd05f6a6569788da9da59522eeca90f3aecbfd94e37.exe

  • Size

    581KB

  • MD5

    0d9efdf9dd6cc7465a3c03ed83f891c7

  • SHA1

    99063fd892a1c9394131ea20ef728e745151428b

  • SHA256

    778dc5f402ea7e860c9e7dd05f6a6569788da9da59522eeca90f3aecbfd94e37

  • SHA512

    ab50b6ec59f6147c3a1f489ffaa70a2cdb49e26ce162a1fde913d4b187850ba8fd8116bce252e871b4b8432f5c3648b7697800b588e17a69cd21a1312ef48f1c

  • SSDEEP

    12288:uoMDtCi7NFlZnNqZ9xGrLpZ0ZHEqtgb0U3:ufplNFgxG5eZngb0E

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\778dc5f402ea7e860c9e7dd05f6a6569788da9da59522eeca90f3aecbfd94e37.exe
    "C:\Users\Admin\AppData\Local\Temp\778dc5f402ea7e860c9e7dd05f6a6569788da9da59522eeca90f3aecbfd94e37.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\nbfile0.exe
      C:\Users\Admin\AppData\Local\Temp\nbfile0.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:864
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.97199.com/install2/?sl3
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:844
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1732
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\nbfile0.exe
        3⤵
          PID:1972
      • C:\Users\Admin\AppData\Local\Temp\nbfile1.exe
        C:\Users\Admin\AppData\Local\Temp\nbfile1.exe
        2⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"
          3⤵
            PID:3752
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\1.vbs"
            3⤵
              PID:4776

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          0ef90204485649be625ea2be1b9018fb

          SHA1

          28fbc0852140ec51d0c097a4962a160afa4d754b

          SHA256

          c8028acd9a8c8c795b87cf835fc3182d003264608f161baa0ca020711b22bca0

          SHA512

          b8bbba0dcc6cb6f87efb47a605953c93fcf93c5a65520b822ebfee25754632d6bb66c2a946f457e1e40a92556683ddb9d14f2703782833e12d7e37bb3b7fcec5

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          434B

          MD5

          f0d564e5b5ea5517ac9920c1d0feebb8

          SHA1

          e6f7062ee8b4498bd3609b9660bbcad4e8815070

          SHA256

          20890f05d2f694728eb8416fbfc2d5bd5e7b26841dd3cd42fb8b52f280b3c0df

          SHA512

          cb70cad63564beb52f0ba6be3f58ac3136e3cac7f23275a1e3c77505ef5a561d4eb9fc6215d8abbcb2a372f93d20a2fb60d7367f5993653302f97acca9ea07b4

        • C:\Users\Admin\AppData\Local\Temp\nbfile0.exe

          Filesize

          467KB

          MD5

          74869a0346ab36bbba85022612505121

          SHA1

          2cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a

          SHA256

          6de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a

          SHA512

          723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5

        • C:\Users\Admin\AppData\Local\Temp\nbfile0.exe

          Filesize

          467KB

          MD5

          74869a0346ab36bbba85022612505121

          SHA1

          2cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a

          SHA256

          6de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a

          SHA512

          723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5

        • C:\Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • C:\Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • C:\newsetup.vbs

          Filesize

          651B

          MD5

          4736e7158c27f244482f5a614b9dbdae

          SHA1

          d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9

          SHA256

          b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc

          SHA512

          cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824

        • memory/864-137-0x0000000000400000-0x000000000048A000-memory.dmp

          Filesize

          552KB

        • memory/864-139-0x0000000000400000-0x000000000048A000-memory.dmp

          Filesize

          552KB