Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

Trojan-Ran...er.exe

windows7-x64

8

Trojan-Ran...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    153s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 06:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan-Ransom.Win32.Blocker.exe

  • Size

    392KB

  • MD5

    07e60c5d7dfb6651e00c5f380cd50894

  • SHA1

    330aafef8d4001d1c80c2dfb3d23e979a874a7c5

  • SHA256

    867c5428d815a2f2d26b333c60f12652c294c62bb20ca8092c98a2f5fb546b1b

  • SHA512

    2aabd98293cd18bd426a7eb522502deabee13fe32b17bad3326340d6e3f9048671ce006b4bdbbe0f1dd781546858151277a792c1335e06e7ae211c43b8503d05

  • SSDEEP

    12288:Ot8vVED3Bk0Mr9Vif7/F1hIIaYHuvAIS28:Ot+gvMpVij/F1hV5HuvAIS

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
      \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4968
      • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
        \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2024
    • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
      \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Drops startup file
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COMLOADER /d "\\.\C:\Program Files\FoxitReader\bin\COM7.EXE"
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:220
      • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
        \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2008

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
    Filesize

    392KB

    MD5

    975a4ee0275bc11ccc8beaa4d5cb00d7

    SHA1

    abd50d96aa7268d1f506e566c5d5c9ad783012a8

    SHA256

    2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

    SHA512

    66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
    Filesize

    392KB

    MD5

    975a4ee0275bc11ccc8beaa4d5cb00d7

    SHA1

    abd50d96aa7268d1f506e566c5d5c9ad783012a8

    SHA256

    2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

    SHA512

    66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
    Filesize

    392KB

    MD5

    975a4ee0275bc11ccc8beaa4d5cb00d7

    SHA1

    abd50d96aa7268d1f506e566c5d5c9ad783012a8

    SHA256

    2b58be880efbb850fc8b98546fe5bcc4184cc38d8ee845787802320ab3b3e09f

    SHA512

    66341bbcefd6790997cc96dbd23cdb34b4e80c6bfa2fda4bb48b69d774fc2ec09a90f7152721c5a44698e2940df4ba00e596b49db59468ab3e545b2255b56a0e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
    Filesize

    392KB

    MD5

    114c0055e3ea2c8a8ff5350d660d7a5e

    SHA1

    2a52a15bca448193394924ab6c1141e2d489c483

    SHA256

    7390721a2b853a8b76bce41ff083e372959cdc4922d133f9c1fea4a7439319ac

    SHA512

    77a27a856e1b6c29bec04bf1cf95dd6e65bd197f4f70762dfc92a3585563497209b26962e43eccb7ecdd85368a26af0b15c3e820de6b6fc13722df74888b6ea2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
    Filesize

    392KB

    MD5

    114c0055e3ea2c8a8ff5350d660d7a5e

    SHA1

    2a52a15bca448193394924ab6c1141e2d489c483

    SHA256

    7390721a2b853a8b76bce41ff083e372959cdc4922d133f9c1fea4a7439319ac

    SHA512

    77a27a856e1b6c29bec04bf1cf95dd6e65bd197f4f70762dfc92a3585563497209b26962e43eccb7ecdd85368a26af0b15c3e820de6b6fc13722df74888b6ea2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
    Filesize

    392KB

    MD5

    114c0055e3ea2c8a8ff5350d660d7a5e

    SHA1

    2a52a15bca448193394924ab6c1141e2d489c483

    SHA256

    7390721a2b853a8b76bce41ff083e372959cdc4922d133f9c1fea4a7439319ac

    SHA512

    77a27a856e1b6c29bec04bf1cf95dd6e65bd197f4f70762dfc92a3585563497209b26962e43eccb7ecdd85368a26af0b15c3e820de6b6fc13722df74888b6ea2

    Download Submit