Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe
Resource
win10v2004-20221111-en
General
-
Target
b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe
-
Size
1.5MB
-
MD5
1a60ada652d623902e38c133e01761de
-
SHA1
83de2362ef7b8ba7469d624379985ac3798f0a2c
-
SHA256
b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a
-
SHA512
fa7cfaccb9710b71c7a849d2c16e36259a6227f98dc97d9ba8c6eea2c59771a3bb810c3834ac4baff0436cfde8fd6c093cf9fd77591e07b609a7f38cc160d5b9
-
SSDEEP
24576:Hpa/O74CNt3r2J2FC3eUldZUJ3OlKU4UDcc6Cy+9eGC:wcZC35VcOcmDcc6CdU
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3804 set thread context of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3040 PING.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2256 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 2256 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 2256 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 2256 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 2256 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3804 wrote to memory of 308 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 84 PID 3804 wrote to memory of 308 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 84 PID 3804 wrote to memory of 308 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 84 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 3804 wrote to memory of 2256 3804 b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe 86 PID 308 wrote to memory of 3040 308 cmd.exe 87 PID 308 wrote to memory of 3040 308 cmd.exe 87 PID 308 wrote to memory of 3040 308 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe"C:\Users\Admin\AppData\Local\Temp\b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -c 5 8.8.8.82⤵
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\PING.EXEping -c 5 8.8.8.83⤵
- Runs ping.exe
PID:3040
-
-
-
C:\Users\Admin\AppData\Local\Temp\b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe"C:\Users\Admin\AppData\Local\Temp\b097e68c05608afa3e0d3bdbd5546616639615d9404af1c34d37fc9451e15f9a.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2256
-