Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 18:49

General

  • Target

    edfdbb51b924bc503979764a107a6b21.exe

  • Size

    1.3MB

  • MD5

    edfdbb51b924bc503979764a107a6b21

  • SHA1

    d5aee7e8fa1c8409df3f8680bd0838e340b02919

  • SHA256

    299f163bfa323164ca2db712eb788d8b71f7c1b7197aed20e23409368f5d9eed

  • SHA512

    0f6a429fe18337890e8445e43bc826c428af256d2691a72701a4a8e4f943943d25b2dcc3ed36a3fd10ffcc8f1609dd1fec3045527c9ee6d118138ec1386aee4d

  • SSDEEP

    24576:KWkI3RbidB+WwCUENepvtCKxGqSMntHnaoyKmQrLL/7hZSqpzyn1IvQqFRM:KZXOWw3XpvcahRnbuQnL/CqpG13ORM

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edfdbb51b924bc503979764a107a6b21.exe
    "C:\Users\Admin\AppData\Local\Temp\edfdbb51b924bc503979764a107a6b21.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
      2⤵
      • Blocklisted process makes network request
      PID:1236
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
      2⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      PID:2664
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 1060
      2⤵
      • Program crash
      PID:624
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 384 -ip 384
    1⤵
      PID:5032

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Wffwew.tmp

      Filesize

      3.5MB

      MD5

      a7d875022bb5e3a34d034b947003d1b3

      SHA1

      5905ca93fea101ce80e5bf8925eb2a7eec1e333d

      SHA256

      bcdf4c540c4289f81c98448d0a4482a96522fb767ab6015e76288afce148226a

      SHA512

      f2b78a100cf0fa84909629b892e548d7ef9797621623a96aa75f15241d7350eecca117c3793056c30dc317ade8ecc0023c2b875516d9c25ac9bb0d880bb3149a

    • memory/384-156-0x0000000003270000-0x0000000003DD0000-memory.dmp

      Filesize

      11.4MB

    • memory/384-155-0x0000000003F40000-0x0000000004080000-memory.dmp

      Filesize

      1.2MB

    • memory/384-135-0x0000000000400000-0x0000000000958000-memory.dmp

      Filesize

      5.3MB

    • memory/384-136-0x0000000000400000-0x0000000000958000-memory.dmp

      Filesize

      5.3MB

    • memory/384-163-0x0000000003270000-0x0000000003DD0000-memory.dmp

      Filesize

      11.4MB

    • memory/384-162-0x0000000000400000-0x0000000000958000-memory.dmp

      Filesize

      5.3MB

    • memory/384-158-0x0000000003F40000-0x0000000004080000-memory.dmp

      Filesize

      1.2MB

    • memory/384-157-0x0000000003F40000-0x0000000004080000-memory.dmp

      Filesize

      1.2MB

    • memory/384-132-0x0000000000400000-0x0000000000958000-memory.dmp

      Filesize

      5.3MB

    • memory/384-148-0x0000000000400000-0x0000000000958000-memory.dmp

      Filesize

      5.3MB

    • memory/384-154-0x0000000003F40000-0x0000000004080000-memory.dmp

      Filesize

      1.2MB

    • memory/384-153-0x0000000003F40000-0x0000000004080000-memory.dmp

      Filesize

      1.2MB

    • memory/384-152-0x0000000003F40000-0x0000000004080000-memory.dmp

      Filesize

      1.2MB

    • memory/384-133-0x000000000270D000-0x000000000282F000-memory.dmp

      Filesize

      1.1MB

    • memory/384-134-0x0000000002830000-0x0000000002AFC000-memory.dmp

      Filesize

      2.8MB

    • memory/384-150-0x0000000003F40000-0x0000000004080000-memory.dmp

      Filesize

      1.2MB

    • memory/384-151-0x0000000003F40000-0x0000000004080000-memory.dmp

      Filesize

      1.2MB

    • memory/384-149-0x0000000003270000-0x0000000003DD0000-memory.dmp

      Filesize

      11.4MB

    • memory/384-147-0x0000000003270000-0x0000000003DD0000-memory.dmp

      Filesize

      11.4MB

    • memory/1236-145-0x0000000000D60000-0x0000000000D63000-memory.dmp

      Filesize

      12KB

    • memory/1236-144-0x0000000000D60000-0x0000000000D63000-memory.dmp

      Filesize

      12KB

    • memory/1236-143-0x0000000000D50000-0x0000000000D53000-memory.dmp

      Filesize

      12KB

    • memory/1236-142-0x0000000000D40000-0x0000000000D43000-memory.dmp

      Filesize

      12KB

    • memory/1236-141-0x0000000000D30000-0x0000000000D33000-memory.dmp

      Filesize

      12KB

    • memory/1236-140-0x0000000000D20000-0x0000000000D23000-memory.dmp

      Filesize

      12KB

    • memory/1236-139-0x0000000000D10000-0x0000000000D13000-memory.dmp

      Filesize

      12KB

    • memory/1236-138-0x0000000000D00000-0x0000000000D03000-memory.dmp

      Filesize

      12KB

    • memory/2664-160-0x0000000000C50000-0x0000000001690000-memory.dmp

      Filesize

      10.2MB

    • memory/2664-161-0x0000000002C30000-0x0000000003790000-memory.dmp

      Filesize

      11.4MB