Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    191s
  • max time network
    246s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 00:29

General

  • Target

    ccd59635f81da8642c2fcf701f71cf1e61ecf4b8f2024f7b09956a4047b1150c.exe

  • Size

    200KB

  • MD5

    3d8e9ec146631bf7560cfaba733284db

  • SHA1

    72a988594a736b3e5e62bc9da88749dfc7082dc8

  • SHA256

    ccd59635f81da8642c2fcf701f71cf1e61ecf4b8f2024f7b09956a4047b1150c

  • SHA512

    1aa6ed09785498490b8dfde7e3bbf38e304559ffc2e6dd842ffea71b89d695c2ecd0b10ac6bc4ee36043b1426eee7696d0449053c8a154aa12f1097764b59b2f

  • SSDEEP

    3072:VCUTo/0Yx30tQ9nLHbB9WPliBs2HWWEakGJm9Bbw:VC5p4QxL7B9WPli+yWWEaziU

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccd59635f81da8642c2fcf701f71cf1e61ecf4b8f2024f7b09956a4047b1150c.exe
    "C:\Users\Admin\AppData\Local\Temp\ccd59635f81da8642c2fcf701f71cf1e61ecf4b8f2024f7b09956a4047b1150c.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3268
    • C:\Users\Admin\woadod.exe
      "C:\Users\Admin\woadod.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4664

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\woadod.exe

    Filesize

    200KB

    MD5

    9b989231984157e7d0849988cc93b65a

    SHA1

    2ac5c5036671e84f2c883df8d8bd7a557afacb0b

    SHA256

    7963bdc45ce7bda7e0df32fcc14771d999a77b0d2736176c54eb863a2b5d51c0

    SHA512

    027a1647bec413dfa64dac489dff269e714e8c764e42a1cccaebe7f5b41612cd4c8b2cffd55ddf94f53e99e063c3281bea311b2138250250a91ea3d81085ef33

  • C:\Users\Admin\woadod.exe

    Filesize

    200KB

    MD5

    9b989231984157e7d0849988cc93b65a

    SHA1

    2ac5c5036671e84f2c883df8d8bd7a557afacb0b

    SHA256

    7963bdc45ce7bda7e0df32fcc14771d999a77b0d2736176c54eb863a2b5d51c0

    SHA512

    027a1647bec413dfa64dac489dff269e714e8c764e42a1cccaebe7f5b41612cd4c8b2cffd55ddf94f53e99e063c3281bea311b2138250250a91ea3d81085ef33