Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
183s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe
Resource
win10v2004-20221111-en
General
-
Target
239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe
-
Size
1.5MB
-
MD5
cb4274cd1a76071e7abc516a4f411b5d
-
SHA1
767a949a1947347f150f0acca6a3d508e4890bca
-
SHA256
239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37
-
SHA512
b0e5b3b74c603c8fe19821b55ada4a2356816d4c5349c522cd1d0761f448d4b56f031ffb838af718fab616983327a4dee9e29bf6b3581d0b2baacc65c0ad1b8c
-
SSDEEP
24576:Hpa/O74CNt3r2J2FC3eUldZUJ3OlKU4UDcc6Cy+9eGH:wcZC35VcOcmDcc6Cd5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3000 set thread context of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4608 PING.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2116 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 2116 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 2116 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 2116 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 2116 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3000 wrote to memory of 4516 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 83 PID 3000 wrote to memory of 4516 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 83 PID 3000 wrote to memory of 4516 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 83 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 3000 wrote to memory of 2116 3000 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 85 PID 4516 wrote to memory of 4608 4516 cmd.exe 86 PID 4516 wrote to memory of 4608 4516 cmd.exe 86 PID 4516 wrote to memory of 4608 4516 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe"C:\Users\Admin\AppData\Local\Temp\239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -c 5 8.8.8.82⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\PING.EXEping -c 5 8.8.8.83⤵
- Runs ping.exe
PID:4608
-
-
-
C:\Users\Admin\AppData\Local\Temp\239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe"C:\Users\Admin\AppData\Local\Temp\239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2116
-