Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    190s
  • max time network
    227s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2022, 21:49

General

  • Target

    9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe

  • Size

    2.6MB

  • MD5

    4bfaf4334b36db4e10e1c7e63a6889af

  • SHA1

    77b2ee9f7e39d548f42da877bda97bff83e9315e

  • SHA256

    9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c

  • SHA512

    4546dc9ba1180038c2f2015c0db1cbed07ac3a042010c2f232104b2e60c7f36614208fa648f7183da99a4c301a0cd9a721eecabd0ca3588c57aa465de312d8d9

  • SSDEEP

    49152:gfJ3tfIakU9sxt4jL148SgiQbEf1AnjxN3NIy0kbp0ik1LrhPm:gfJ9fRkU9sxtQOgPbaajxzIobp0iE

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe
    "C:\Users\Admin\AppData\Local\Temp\9d2567186d3a196374a2d2bcde216cabe171a8412e5de385e3b2337597d6d18c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://schftx.taobao.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3208
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.weishiwg.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 2300
      2⤵
      • Program crash
      PID:2272
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 1792
      2⤵
      • Program crash
      PID:4712
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4268 -ip 4268
    1⤵
      PID:4040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4268 -ip 4268
      1⤵
        PID:1300

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{147EC300-6E6C-11ED-BF5F-7295FC24CA51}.dat

        Filesize

        5KB

        MD5

        6b0b043791a0282cbc43b96983ae3b40

        SHA1

        4afd54f9cf5c50e2a06254c86ce29f4f895c93d4

        SHA256

        504bc0e925dc2e75a4d34795cf214aae403df64f96b149e5c2e2f3a3f2116072

        SHA512

        2117f5798cc68052f0d0048f155121dc616c06f88f6a2b47af9344946aa46b8d6fd4d99011505765b6819b47e84fddadf32940e5824b9bd21045cb44b2ea4be4

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{14812606-6E6C-11ED-BF5F-7295FC24CA51}.dat

        Filesize

        5KB

        MD5

        faa1990830b235f3030812ed7e4d3993

        SHA1

        56e368ff9a6eddf8c5bdd323e10a8464b0952390

        SHA256

        16d779d1dac1e5e155dec091d966699fa9ce461d82f79e5dd352650f13bac2ce

        SHA512

        b10771f8d0c32d11aa1d23635c7382698a6b6ea527451ed983fa033cdca88fcccf233001d642ea186d23881c41545b3e17f509f90915210c628c06e8ecfaeefb

      • memory/4268-153-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-165-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-137-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-138-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-139-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-141-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-143-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-145-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-163-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-149-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-151-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-157-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-155-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-159-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-136-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-132-0x0000000000400000-0x0000000000A81000-memory.dmp

        Filesize

        6.5MB

      • memory/4268-147-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-161-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-167-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-171-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-173-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-169-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-175-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-177-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-179-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-180-0x0000000000400000-0x0000000000A81000-memory.dmp

        Filesize

        6.5MB

      • memory/4268-181-0x0000000000400000-0x0000000000A81000-memory.dmp

        Filesize

        6.5MB

      • memory/4268-182-0x00000000774A0000-0x0000000077643000-memory.dmp

        Filesize

        1.6MB

      • memory/4268-183-0x0000000000400000-0x0000000000A81000-memory.dmp

        Filesize

        6.5MB

      • memory/4268-184-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-134-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/4268-133-0x00000000774A0000-0x0000000077643000-memory.dmp

        Filesize

        1.6MB