Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    189s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2022, 18:11

General

  • Target

    76b7f8f5c4e92c938d4a2ff504a52eb2ed5ee07c6879a4d80cf91f2c631a2bbf.exe

  • Size

    320KB

  • MD5

    5965790c4d4f6f570563d9f658225450

  • SHA1

    f9893bbe4d7337239481a250d41b68133b4892e9

  • SHA256

    76b7f8f5c4e92c938d4a2ff504a52eb2ed5ee07c6879a4d80cf91f2c631a2bbf

  • SHA512

    115d0014db59d8ffe990ca8b686e8cb12644626e1b657fd6f8b2b24ffc2b3703369b5c815cc8e8f2a37e9a48f974dd592ff6d491ccebc97ccbf2f1d8da035f80

  • SSDEEP

    6144:CpHIcFeEK/fObT/bGibErxUyF+fmYYdPMAaiSeg:C5IcFeEK/fObT/bGiPo+eYYt/LSeg

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 54 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76b7f8f5c4e92c938d4a2ff504a52eb2ed5ee07c6879a4d80cf91f2c631a2bbf.exe
    "C:\Users\Admin\AppData\Local\Temp\76b7f8f5c4e92c938d4a2ff504a52eb2ed5ee07c6879a4d80cf91f2c631a2bbf.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4412
    • C:\Users\Admin\yaaja.exe
      "C:\Users\Admin\yaaja.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4720

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\yaaja.exe

    Filesize

    320KB

    MD5

    f949ac379fb636c3fed1bb0e952d9d2c

    SHA1

    1060da513a091834bbb215b52623279c5655dabb

    SHA256

    10783d0cb04406129fc677f5cbd5007b9552ece0aa79a14dff6be07b06c6bb32

    SHA512

    9e9f8fdb22faa93e22f88b34129b7245fec4577975ede905f02a5436c038ebe9dadffebcce483d443791cb584ea77851403417ed1659045f67cde6b4a7fda52c

  • C:\Users\Admin\yaaja.exe

    Filesize

    320KB

    MD5

    f949ac379fb636c3fed1bb0e952d9d2c

    SHA1

    1060da513a091834bbb215b52623279c5655dabb

    SHA256

    10783d0cb04406129fc677f5cbd5007b9552ece0aa79a14dff6be07b06c6bb32

    SHA512

    9e9f8fdb22faa93e22f88b34129b7245fec4577975ede905f02a5436c038ebe9dadffebcce483d443791cb584ea77851403417ed1659045f67cde6b4a7fda52c