Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
Resource
win10v2004-20220901-en
General
-
Target
533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
-
Size
213KB
-
MD5
3f83802b28a76223445ed1aee2f8cdf0
-
SHA1
3d68789453f1c68ea396db44b322f0c57d92d66e
-
SHA256
533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4
-
SHA512
06f0114cdc4c569a7907ce4abe7190c22a138d6658c36f96446fecafde9e6b5c94fa4ac39de5490792a3636654c563ed74005ca62effb048c6e8740b91e1ff85
-
SSDEEP
1536:/5AiTLOQ74YDtnlN5UL09atT0mBBAragjSvIYFwAmd/olQpNuI:/53mQ7JtnP5I09qgmBBAWgjSvwN/olWT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4244 jusched.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run 533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\b0fd3d68\jusched.exe 533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe File created C:\Program Files (x86)\b0fd3d68\b0fd3d68 533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job 533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5044 wrote to memory of 4244 5044 533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe 82 PID 5044 wrote to memory of 4244 5044 533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe 82 PID 5044 wrote to memory of 4244 5044 533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe"C:\Users\Admin\AppData\Local\Temp\533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Program Files (x86)\b0fd3d68\jusched.exe"C:\Program Files (x86)\b0fd3d68\jusched.exe"2⤵
- Executes dropped EXE
PID:4244
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD54d77d6b250ffb567743b8dbcdad695b8
SHA1d5a8f98f9433f6d36c74df463cef3e2cf524462d
SHA2567ec7a3a23890c3592f5b762aecf11adbf8831fad11b8048aedfa7315d599c5f2
SHA5125655153049101fd67125d484c81f1ad30b44f36f00e3aabfe8d730a21661f4b394357b60da549289def4311b4cc7bd508d8fd6b8db254cd442b2152f8902bd71
-
Filesize
213KB
MD53b1b35d1ba1fb64882084d3877069d52
SHA1886ca818fe4340e8c8358648408873b1b73433ca
SHA256ad847c4f2ef02655207f7b8943ce2707340ca91436ee5f9a877acd3b6f906ea1
SHA512479e34033d0b74218590d2d4a089e44596315f08c615e73c39ffb2f565a4c9aa00c99c91eda5f0691ea94bf1b0a4fed1fca376bc6a30319d53bacde626fe060d
-
Filesize
213KB
MD53b1b35d1ba1fb64882084d3877069d52
SHA1886ca818fe4340e8c8358648408873b1b73433ca
SHA256ad847c4f2ef02655207f7b8943ce2707340ca91436ee5f9a877acd3b6f906ea1
SHA512479e34033d0b74218590d2d4a089e44596315f08c615e73c39ffb2f565a4c9aa00c99c91eda5f0691ea94bf1b0a4fed1fca376bc6a30319d53bacde626fe060d