Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

Trojan-Ran...er.exe

windows7-x64

10

Trojan-Ran...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 04:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan-Ransom.Win32.Blocker.exe

  • Size

    802KB

  • MD5

    2558f8a8234fc3e4db65a9c412d437b7

  • SHA1

    972875b6ed00a202e0bb525cd5a9e6a7bef27322

  • SHA256

    eb6d8fc63554f3f02119dcf03ba021451f9ee21c63c8075111299709ac144d6b

  • SHA512

    a764bf045386a3f4ad10160714db7f8a7be227bf88a54e33da09e43cb1200c18898376b4f71a1499214c43492ff0c15c072d28452e1b261275631d78e6fa42ab

  • SSDEEP

    1536:+EfFNvtgmAl7z5dKY6yuJPW8K43w9NXOM1aRl/i6JWT0S9yXnBibnouy8gHn2JX:+YLmGO4W849NXO9RlK6gOxiDouto2N

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2200
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:3736
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4212 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4500

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      2KB

      MD5

      0774dce1dca53ce5c4f06846dc34a01a

      SHA1

      b66a92ae7ae2abc81921ed83fea0886c908b14b3

      SHA256

      653df1e7ee6eb78011d131d41eebad55a6b11e14073ac204587960c404d2300f

      SHA512

      43582562e20238142d801d97dee6efff1213d38506dc8e21001517d799e52c5157a0ce814e29045fb267200878e964f04d05bb209ac738d510b48ebd689b82e2

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      0ef90204485649be625ea2be1b9018fb

      SHA1

      28fbc0852140ec51d0c097a4962a160afa4d754b

      SHA256

      c8028acd9a8c8c795b87cf835fc3182d003264608f161baa0ca020711b22bca0

      SHA512

      b8bbba0dcc6cb6f87efb47a605953c93fcf93c5a65520b822ebfee25754632d6bb66c2a946f457e1e40a92556683ddb9d14f2703782833e12d7e37bb3b7fcec5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      Filesize

      1KB

      MD5

      be2b5211e42eb9225d21358e7eb3f78f

      SHA1

      35b1ab3adde0a5f3cad8862897f1ea7a86946349

      SHA256

      3185aa19aba785efc822b72e3f2959e07343c1935f8f2b46a4438060763c9111

      SHA512

      9b20c8dceb160aad20de302c2589b86fae64f7842b370812fd8baba3e8154a357c0a1c282ea95fbc5406ab093593637929edaf83c42e19c7b6a011d286b06b6a

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
      Filesize

      472B

      MD5

      348f6c5d513404b3c3c6c27f3de2dfdf

      SHA1

      acb18df838bf8ddb2667e944a82b2930bdecfad8

      SHA256

      a46606d9bc72c7330fff6849e1caa6c773c79d66236549408380362d28d892a1

      SHA512

      79dd389bc9a05312290bf69386faa56fd5a6515a0efd7685249831732f6a7c948ac41f288e038a65929e1b56f8fc615db12b7d3955a5e3279ebc8895fd150cab

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
      Filesize

      472B

      MD5

      348f6c5d513404b3c3c6c27f3de2dfdf

      SHA1

      acb18df838bf8ddb2667e944a82b2930bdecfad8

      SHA256

      a46606d9bc72c7330fff6849e1caa6c773c79d66236549408380362d28d892a1

      SHA512

      79dd389bc9a05312290bf69386faa56fd5a6515a0efd7685249831732f6a7c948ac41f288e038a65929e1b56f8fc615db12b7d3955a5e3279ebc8895fd150cab

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      488B

      MD5

      5abb8a3fb81d2bbe873ccf05988ae260

      SHA1

      07ca99b809301f3071ed755aec8db36440410db2

      SHA256

      5cfd2b523d8d5eaafed35dba8a765bc7f3c42030af7bc575e000fbaeab1848b7

      SHA512

      cd8ad1505111af13053b1861c918a101f1f1e1fe1022a76ca873f495b7567716bb857fd23b31cdfe60e45555ea910d978a41e9961ae700971afacc4b6208f281

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      434B

      MD5

      ed99d5d25916ff9785527472be91a5dc

      SHA1

      f25f8efe26555f128a2bc1eac9cbcf60516569c7

      SHA256

      a33bb7456f862e4c1cf0ab9b5374c3aeb397034f66c495b48ad124c5874e90ff

      SHA512

      848faedea92f608144353ef03bb153d111118c2349d00c15f8fb82fac7575bf5d3935f4bd5fc04ffcf337d5a397171960dd88c669ceb1fd3d28b45b30f87e69f

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      Filesize

      482B

      MD5

      41ec6d313008262aa6bd91dee42d83ce

      SHA1

      33d82aa65ff746647f7b98e1ab5225676c1fe657

      SHA256

      1f7ed6f2d8d0714945f00e264cebeeeadae9f26191b1c2d2b69dd2982b26de8a

      SHA512

      9ab72f8adae8002e6c396117498e808b1dc48faeec8fd6c868a31ea97f9aeec3bcd8b7f37ab9a2ed467faccba829186a72e234780222773751e976b6ace6b8ce

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
      Filesize

      480B

      MD5

      9963d32e8ef3580fa1d38476b93cb27a

      SHA1

      4d335bffd081f1ad53d4d8a5d7c814e230dca108

      SHA256

      718501f9b764b06106f9b5a8ededa0a7a2ee8bd980fa177a6a48fc2a59d9cc3d

      SHA512

      8905a20e86d7ee9e0cf055ef03475c560546d70ed774879adcd9e86b6fc5a0f6c4ab8fe8297808e5ef0c4a8e63210a384c98ff4649eb143b8ebe4e308f2aade8

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
      Filesize

      480B

      MD5

      d69572f9ed9496c37f05cd5df363c745

      SHA1

      fbb7e2b722d7b9917e9753cf3bc8180638266de3

      SHA256

      e90f018a6ebceec700d5b6b44a3e2dbdc5baeb8f2eaa9c48c37b157bc0e273d8

      SHA512

      673309857b6c12242e86e02fc1ddd5f8923842149d53da4204f30b1b5890038c7fc7e734427a34805c46e8ea545fe3ea4503e0c35a143c247decb26b0419af0d

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      802KB

      MD5

      2558f8a8234fc3e4db65a9c412d437b7

      SHA1

      972875b6ed00a202e0bb525cd5a9e6a7bef27322

      SHA256

      eb6d8fc63554f3f02119dcf03ba021451f9ee21c63c8075111299709ac144d6b

      SHA512

      a764bf045386a3f4ad10160714db7f8a7be227bf88a54e33da09e43cb1200c18898376b4f71a1499214c43492ff0c15c072d28452e1b261275631d78e6fa42ab

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      802KB

      MD5

      2558f8a8234fc3e4db65a9c412d437b7

      SHA1

      972875b6ed00a202e0bb525cd5a9e6a7bef27322

      SHA256

      eb6d8fc63554f3f02119dcf03ba021451f9ee21c63c8075111299709ac144d6b

      SHA512

      a764bf045386a3f4ad10160714db7f8a7be227bf88a54e33da09e43cb1200c18898376b4f71a1499214c43492ff0c15c072d28452e1b261275631d78e6fa42ab

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      802KB

      MD5

      2558f8a8234fc3e4db65a9c412d437b7

      SHA1

      972875b6ed00a202e0bb525cd5a9e6a7bef27322

      SHA256

      eb6d8fc63554f3f02119dcf03ba021451f9ee21c63c8075111299709ac144d6b

      SHA512

      a764bf045386a3f4ad10160714db7f8a7be227bf88a54e33da09e43cb1200c18898376b4f71a1499214c43492ff0c15c072d28452e1b261275631d78e6fa42ab

      Download Submit

    • memory/1052-141-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2200-147-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/2200-154-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/2200-157-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/2200-146-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/2200-143-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/4032-132-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4032-139-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download