Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
85s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe
Resource
win10v2004-20220901-en
General
-
Target
6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe
-
Size
208KB
-
MD5
06371953079ee30062990ae307693a09
-
SHA1
626802beb32d34c1013d046f6909ffc43f39d979
-
SHA256
6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58
-
SHA512
22c1dc68999510ab2d5f3ccd02173c3f3cb5b4a7c02da68f00492df89b050bcf708d1ce12d54e10f41dde899b8572dbd1b35dc9e2b6dff5cc17d3c53dbe956ec
-
SSDEEP
3072:bChJgYMm4xf9cU9KQ2BxA59SPMpOoIn2s:3YMm4xiWKQ2BiCM8
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3816 jusched.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run 6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\199828e1\jusched.exe 6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe File created C:\Program Files (x86)\199828e1\199828e1 6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job 6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4424 wrote to memory of 3816 4424 6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe 84 PID 4424 wrote to memory of 3816 4424 6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe 84 PID 4424 wrote to memory of 3816 4424 6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe"C:\Users\Admin\AppData\Local\Temp\6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Program Files (x86)\199828e1\jusched.exe"C:\Program Files (x86)\199828e1\jusched.exe"2⤵
- Executes dropped EXE
PID:3816
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD589931a70501a3362b6823b53523f5a77
SHA188c7e199c462ed8cc3af0ba453512b5b1fdcfdb5
SHA256d30d9a0e64bc9f4a306617f087f30de6d57a5413793ab7bde13a299777a1b254
SHA5128fa7ab4824ae86f3f47b3718c11f79ef275dd0639396572eaeb1262ad9153ccf43c633a7b292e30c97370436a09f22fbcf817a802015650ffb1f84d2b83483bd
-
Filesize
208KB
MD50718f35836f48f555b40fb9fdbfb5228
SHA10f8f9f994c0be25eeade80a8f7d40aade381859a
SHA25630b62ab05946d939b0309b12b99e583307e0aeee8b5e5417ad45383043ffb660
SHA512907ce6dfd7ebbe95da6ef8fc666ca541e28f07fc09ed62093b860e71da7dffbe6eb6cbf319663a6286316381e6492d5344d76d33cb62a1891f8e70fcf00d8091
-
Filesize
208KB
MD50718f35836f48f555b40fb9fdbfb5228
SHA10f8f9f994c0be25eeade80a8f7d40aade381859a
SHA25630b62ab05946d939b0309b12b99e583307e0aeee8b5e5417ad45383043ffb660
SHA512907ce6dfd7ebbe95da6ef8fc666ca541e28f07fc09ed62093b860e71da7dffbe6eb6cbf319663a6286316381e6492d5344d76d33cb62a1891f8e70fcf00d8091