Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe
Resource
win10v2004-20220901-en
General
-
Target
9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe
-
Size
1.9MB
-
MD5
68075729b8309da2d713f6889c56e5ee
-
SHA1
128aae7ab7937ee67b57078c8967ef9fa563773f
-
SHA256
9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007
-
SHA512
07cec513127965c095ef918a8a48d0f267a85ac41943150f8277277ffe972a28299cdc60f7b1b5f4747c88ef32acfe5a30087c511fca7702f1018fdc643c2369
-
SSDEEP
24576:IwsjEj8VmoUGsqGzqMu1uTd7D0wb+VFC4ifvMNcgkLCZz/IUBxWzQYuyBSGG5l1:IwsjhVhslqMsiZfb+PifvrgkLmmQVyBe
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0003000000022ded-133.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 3288 zz.exe -
resource yara_rule behavioral2/files/0x0003000000022ded-133.dat upx behavioral2/memory/5080-137-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\zz.exe 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 2356 5080 WerFault.exe 75 4948 5080 WerFault.exe 75 -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe 3288 zz.exe 3288 zz.exe 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5080 wrote to memory of 3288 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe 76 PID 5080 wrote to memory of 3288 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe 76 PID 5080 wrote to memory of 3288 5080 9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe"C:\Users\Admin\AppData\Local\Temp\9bb43731176fb0c5a822e006b33f6b1598c2bfb3cdff217a6864612c59202007.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Program Files\Internet Explorer\zz.exe"C:\Program Files\Internet Explorer\zz.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 16842⤵
- Program crash
PID:2356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 16842⤵
- Program crash
PID:4948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5080 -ip 50801⤵PID:3508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5080 -ip 50801⤵PID:4912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD5500f4ba64f32b8f633bef1912b32d53d
SHA10ee886f7783b95b601cc8e9248da75aa07341803
SHA2564fd18cbdb8220aec50e1194bc4a91fb43e077611ed61fc4fe4a5c49f9d9b5fa7
SHA512bd690661338a1a7ebebd043e1fc0c8c236208308569b174a8730255ae5129e75b827979f878376cc8ae50eb0cad0bd9a2736df19b8344ac2cd302cd0182c89df
-
Filesize
672KB
MD5500f4ba64f32b8f633bef1912b32d53d
SHA10ee886f7783b95b601cc8e9248da75aa07341803
SHA2564fd18cbdb8220aec50e1194bc4a91fb43e077611ed61fc4fe4a5c49f9d9b5fa7
SHA512bd690661338a1a7ebebd043e1fc0c8c236208308569b174a8730255ae5129e75b827979f878376cc8ae50eb0cad0bd9a2736df19b8344ac2cd302cd0182c89df
-
Filesize
86KB
MD5147127382e001f495d1842ee7a9e7912
SHA192d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
SHA256edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
SHA51297f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d