Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 03:52

General

  • Target

    f8f7aaa0c52efd8ea923150e79e6eede00e51095f508a8d00f40b28181d8342b.exe

  • Size

    2.1MB

  • MD5

    011e239e4dc9b58f3ce1ca06e79487c2

  • SHA1

    2be90c1e8dc1719e6fb66bdd13d3c96048e70d71

  • SHA256

    f8f7aaa0c52efd8ea923150e79e6eede00e51095f508a8d00f40b28181d8342b

  • SHA512

    9c9e5baf42d98815e5a96a3493853e1fd1c79b2a0b0aaf499e91e6a4ff3082f8a882cdca9bad447901d2225a464ed830e03b6376de8410191071885e64a78d69

  • SSDEEP

    24576:h1OYdaOmqU2Uzf55ilCfBJyvWSzbDBXEZc78KU88S7hrQzcl:h1OsIqBI55ilCf0jvThr4U

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 20 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8f7aaa0c52efd8ea923150e79e6eede00e51095f508a8d00f40b28181d8342b.exe
    "C:\Users\Admin\AppData\Local\Temp\f8f7aaa0c52efd8ea923150e79e6eede00e51095f508a8d00f40b28181d8342b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Users\Admin\AppData\Local\Temp\7zSD9BB.tmp\CBlzvpwQkCz2SNs.exe
      .\CBlzvpwQkCz2SNs.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\CBlzvpwQkCz2SNs.exe
        "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\CBlzvpwQkCz2SNs.exe" target ".\" bits downExt
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /u /s ".\\OSUhfOuBsC42O8.x64.dll"
          4⤵
            PID:116
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /c start /min cmd /c "(echo @echo off > "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo bitsadmin /complete 4222663037-1834984341 ^> nul >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo net stop bits ^> nul >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo net start bits ^> nul >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo bitsadmin /cancel 4222663037-1834984341 ^> nul >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo if exist "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\bubit.dll" goto q >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & for /f %i in ('dir /a:-d /b /w "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\*"') do (echo start /b /min regsvr32.exe /s /n /i:"" "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\%i" >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat")) > nul & echo :q >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo start /b /min regsvr32.exe /s /n /i:"" "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\bubit.dll" >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo del "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" ^& exit >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat""
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\system32\cmd.exe
        cmd /c "(echo @echo off > "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo bitsadmin /complete 4222663037-1834984341 ^> nul >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo net stop bits ^> nul >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo net start bits ^> nul >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo bitsadmin /cancel 4222663037-1834984341 ^> nul >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo if exist "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\bubit.dll" goto q >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & for /f %i in ('dir /a:-d /b /w "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\*"') do (echo start /b /min regsvr32.exe /s /n /i:"" "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\%i" >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat")) > nul & echo :q >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo start /b /min regsvr32.exe /s /n /i:"" "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\bubit.dll" >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & echo del "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" ^& exit >> "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat" & "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\r.bat""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c dir /a:-d /b /w "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\*"
          3⤵
            PID:2180
          • C:\Windows\system32\bitsadmin.exe
            bitsadmin /complete 4222663037-1834984341
            3⤵
              PID:3228
            • C:\Windows\system32\net.exe
              net stop bits
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4572
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop bits
                4⤵
                  PID:1884
              • C:\Windows\system32\net.exe
                net start bits
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2848
              • C:\Windows\system32\bitsadmin.exe
                bitsadmin /cancel 4222663037-1834984341
                3⤵
                  PID:376
                • C:\Windows\system32\regsvr32.exe
                  regsvr32.exe /s /n /i:"" "C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\bubit.dll"
                  3⤵
                    PID:5032
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 start bits
                1⤵
                  PID:4196

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\7zSD9BB.tmp\CBlzvpwQkCz2SNs.dat

                  Filesize

                  15KB

                  MD5

                  f80ef8f1c58bbc198b217acc585dac7d

                  SHA1

                  118bdebc4a0a93e06dbe3f0ce904d20eedb80350

                  SHA256

                  50f4ce00306d27c5ad35b5d0d4680d56e6c0ba78e8221929cee536788cf250ea

                  SHA512

                  ef8e87be8f73147f63620b15d5d9d0cde4f0761afff518631fed321261a4063a03ffea2fb113d72a1cf3e9cb3f3a637cb52f3f57ba51de8b9e2bf5a8e5c3e706

                • C:\Users\Admin\AppData\Local\Temp\7zSD9BB.tmp\CBlzvpwQkCz2SNs.exe

                  Filesize

                  218KB

                  MD5

                  9f6c52eec607111136cd222b02bf0530

                  SHA1

                  57f3815d0942e3b0a9bef621a7b4971f55fc74d7

                  SHA256

                  7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

                  SHA512

                  6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

                • C:\Users\Admin\AppData\Local\Temp\7zSD9BB.tmp\CBlzvpwQkCz2SNs.exe

                  Filesize

                  218KB

                  MD5

                  9f6c52eec607111136cd222b02bf0530

                  SHA1

                  57f3815d0942e3b0a9bef621a7b4971f55fc74d7

                  SHA256

                  7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

                  SHA512

                  6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

                • C:\Users\Admin\AppData\Local\Temp\7zSD9BB.tmp\OSUhfOuBsC42O8.dll

                  Filesize

                  863KB

                  MD5

                  61d272222a2bd7801d81f84432ec3947

                  SHA1

                  d5aa29570591c3ec8ab3525f450796e0549c309b

                  SHA256

                  ad857b00bbd5c29ccca5fe9f628dc44515d0bcaaa5bb0cc48215bbbac4bbd12d

                  SHA512

                  48ce5ae10038f74e8eb6c0703a84abb018dd9301acd163012466cb37f76f0b01a0c89d0a6bf9d99335928302a9b8ef5946ccb4ec49d0fff31f6d50f9311ec239

                • C:\Users\Admin\AppData\Local\Temp\7zSD9BB.tmp\OSUhfOuBsC42O8.tlb

                  Filesize

                  5KB

                  MD5

                  1ca45b386c7b01e1bd45ef4e291d3f70

                  SHA1

                  dcabb955bc45b182231459d7e64cba59592c907e

                  SHA256

                  495c35bf29cd1c6e4a736db79e87203b6fd0c1345343dab958e5d9a4b087754c

                  SHA512

                  87dc04954e21af239f1cd8a300d7ea34c0de9580598080df8e2e75d347ad0232770b37d648db772f5d854a553f395a1fe9c010071ee76024f64ed819371fe752

                • C:\Users\Admin\AppData\Local\Temp\7zSD9BB.tmp\OSUhfOuBsC42O8.x64.dll

                  Filesize

                  945KB

                  MD5

                  966909532c893112bc268ab3062f83e5

                  SHA1

                  8b04dd2ae5c36cba93d2171ea09a26d12175235e

                  SHA256

                  cdfbb548f02dc87d39d399c8b219a5a0c820d49b760da011812e0a8c38ab70fa

                  SHA512

                  38ea4a65dbbe4b6f697e5ff5464741ab073e85fd55bd04c4e362672048451b860fd5f8fea07be211b54e60327c16a22b847997e9ef5b9de84a86fb62334839a3

                • C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\CBlzvpwQkCz2SNs.dat

                  Filesize

                  15KB

                  MD5

                  f80ef8f1c58bbc198b217acc585dac7d

                  SHA1

                  118bdebc4a0a93e06dbe3f0ce904d20eedb80350

                  SHA256

                  50f4ce00306d27c5ad35b5d0d4680d56e6c0ba78e8221929cee536788cf250ea

                  SHA512

                  ef8e87be8f73147f63620b15d5d9d0cde4f0761afff518631fed321261a4063a03ffea2fb113d72a1cf3e9cb3f3a637cb52f3f57ba51de8b9e2bf5a8e5c3e706

                • C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\CBlzvpwQkCz2SNs.exe

                  Filesize

                  218KB

                  MD5

                  9f6c52eec607111136cd222b02bf0530

                  SHA1

                  57f3815d0942e3b0a9bef621a7b4971f55fc74d7

                  SHA256

                  7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

                  SHA512

                  6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

                • C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\CBlzvpwQkCz2SNs.exe

                  Filesize

                  218KB

                  MD5

                  9f6c52eec607111136cd222b02bf0530

                  SHA1

                  57f3815d0942e3b0a9bef621a7b4971f55fc74d7

                  SHA256

                  7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

                  SHA512

                  6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

                • C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\OSUhfOuBsC42O8.dll

                  Filesize

                  863KB

                  MD5

                  61d272222a2bd7801d81f84432ec3947

                  SHA1

                  d5aa29570591c3ec8ab3525f450796e0549c309b

                  SHA256

                  ad857b00bbd5c29ccca5fe9f628dc44515d0bcaaa5bb0cc48215bbbac4bbd12d

                  SHA512

                  48ce5ae10038f74e8eb6c0703a84abb018dd9301acd163012466cb37f76f0b01a0c89d0a6bf9d99335928302a9b8ef5946ccb4ec49d0fff31f6d50f9311ec239

                • C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\OSUhfOuBsC42O8.dll

                  Filesize

                  863KB

                  MD5

                  61d272222a2bd7801d81f84432ec3947

                  SHA1

                  d5aa29570591c3ec8ab3525f450796e0549c309b

                  SHA256

                  ad857b00bbd5c29ccca5fe9f628dc44515d0bcaaa5bb0cc48215bbbac4bbd12d

                  SHA512

                  48ce5ae10038f74e8eb6c0703a84abb018dd9301acd163012466cb37f76f0b01a0c89d0a6bf9d99335928302a9b8ef5946ccb4ec49d0fff31f6d50f9311ec239

                • C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\OSUhfOuBsC42O8.tlb

                  Filesize

                  5KB

                  MD5

                  1ca45b386c7b01e1bd45ef4e291d3f70

                  SHA1

                  dcabb955bc45b182231459d7e64cba59592c907e

                  SHA256

                  495c35bf29cd1c6e4a736db79e87203b6fd0c1345343dab958e5d9a4b087754c

                  SHA512

                  87dc04954e21af239f1cd8a300d7ea34c0de9580598080df8e2e75d347ad0232770b37d648db772f5d854a553f395a1fe9c010071ee76024f64ed819371fe752

                • C:\Users\Admin\AppData\Local\Temp\HNJZLV.tmp\OSUhfOuBsC42O8.x64.dll

                  Filesize

                  945KB

                  MD5

                  966909532c893112bc268ab3062f83e5

                  SHA1

                  8b04dd2ae5c36cba93d2171ea09a26d12175235e

                  SHA256

                  cdfbb548f02dc87d39d399c8b219a5a0c820d49b760da011812e0a8c38ab70fa

                  SHA512

                  38ea4a65dbbe4b6f697e5ff5464741ab073e85fd55bd04c4e362672048451b860fd5f8fea07be211b54e60327c16a22b847997e9ef5b9de84a86fb62334839a3