Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    158s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2022, 11:26

General

  • Target

    105.exe

  • Size

    555KB

  • MD5

    6494681c2245762c201fb9d0168a400f

  • SHA1

    eaf39ecfb2648ac66f8e60bf63558f3d72fd9928

  • SHA256

    e9904b7bcc2f754d895f293be21430c96f8278a449f48a346cf68036782dbfbb

  • SHA512

    7e63b20e05fb894757505e99db8e43927e98bb5bcd0f84a5e035187536fedda5f5441711c5e22168fe59dbe5224cd7acf7836cb1e65a4dfd4b38e95dd8fce62c

  • SSDEEP

    12288:9rI128T22OA9bwbz8elTAOJlB1CrbFFXi:Vr8T2iJwbz80MOzurbfS

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\105.exe
    "C:\Users\Admin\AppData\Local\Temp\105.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderName\mata.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4832
      • C:\Windows\SysWOW64\wscript.exe
        wscript.exe "C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat" "
          4⤵
          • Drops startup file
          PID:3504
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Executes dropped EXE
      • Sets file execution options in registry
      • Checks computer location settings
      • Checks for any installed AV software in registry
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3508
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x57B80732" /TR "C:\ProgramData\taskmanagr\gipkhwvqs.exe" /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:444
      • C:\Windows\SysWOW64\WerFault.exe
        "C:\Windows\SysWOW64\WerFault.exe"
        3⤵
          PID:732
      • C:\Users\Admin\AppData\Local\Temp\Sample .exe
        "C:\Users\Admin\AppData\Local\Temp\Sample .exe"
        2⤵
        • Executes dropped EXE
        PID:3516
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 220
          3⤵
          • Program crash
          PID:4484
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 1060
            4⤵
            • Program crash
            PID:988
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FolderName\Sample.bat" "
        2⤵
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2324
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 60
          3⤵
          • Checks processor information in registry
          • Delays execution with timeout.exe
          • Suspicious behavior: EnumeratesProcesses
          PID:1352
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 744
            4⤵
            • Program crash
            PID:3096
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 736
          3⤵
          • Program crash
          PID:2680
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderName\melt.bat
        2⤵
          PID:3840
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3516 -ip 3516
        1⤵
          PID:1340
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4484 -ip 4484
          1⤵
            PID:884
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2324 -ip 2324
            1⤵
              PID:2856
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1352 -ip 1352
              1⤵
                PID:3168
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3096 -ip 3096
                1⤵
                  PID:4616

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\FolderName\Sample.bat

                  Filesize

                  208B

                  MD5

                  f8c040e23e296396fdf4cce9ee677d43

                  SHA1

                  3a575ef818fbfd1956029320ead8d9856f020ee9

                  SHA256

                  9715cca86ed251841f2fb00c40fe14b91836389d47a2936afb938d1bc39d5616

                  SHA512

                  b24b0ff7bef8fad791cf14fc8e2c3a74db3d4ab668ce13e10fa4a9964228020ca59b84455b81ef1800e1d816351b16198978289d3a395b69a2421769289d8422

                • C:\Users\Admin\AppData\Local\Temp\FolderName\file.exe

                  Filesize

                  555KB

                  MD5

                  6494681c2245762c201fb9d0168a400f

                  SHA1

                  eaf39ecfb2648ac66f8e60bf63558f3d72fd9928

                  SHA256

                  e9904b7bcc2f754d895f293be21430c96f8278a449f48a346cf68036782dbfbb

                  SHA512

                  7e63b20e05fb894757505e99db8e43927e98bb5bcd0f84a5e035187536fedda5f5441711c5e22168fe59dbe5224cd7acf7836cb1e65a4dfd4b38e95dd8fce62c

                • C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbs

                  Filesize

                  78B

                  MD5

                  c578d9653b22800c3eb6b6a51219bbb8

                  SHA1

                  a97aa251901bbe179a48dbc7a0c1872e163b1f2d

                  SHA256

                  20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

                  SHA512

                  3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

                • C:\Users\Admin\AppData\Local\Temp\FolderName\mata.bat

                  Filesize

                  69B

                  MD5

                  c96a3b31fc4a115c977ce5d8a3256f4f

                  SHA1

                  8c71b0d75099af30ac1fe33266e3970b47ba716d

                  SHA256

                  a5b672a4863abcf46556d2e606b2833e8897a3206e554ad93043a82a792df49e

                  SHA512

                  f4337e85ca0b3c0242c35a09f1ff7154c9e37ea3c7de3c2337385fb4b57e25a8550877ce2f37d023c94a3fa69b2b4e003207790297879d29a5bbe4856d0a0f48

                • C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat

                  Filesize

                  176B

                  MD5

                  b77f8e41f69f39412b204cc781212baa

                  SHA1

                  38d70fce7d44d1935955cf4b519664c7969d5989

                  SHA256

                  05ebddcab0758b634954345905825e611eed207bbbb989e6dded1e3476e5deab

                  SHA512

                  8b404359b8c854822fb97262c55dad5293a75d353ba2a2210840c9fbbea96e3ff985856601bb6ca4d10bc21effb3af33558e0c2d9c90128133ae35fe09dccb61

                • C:\Users\Admin\AppData\Local\Temp\FolderName\melt.bat

                  Filesize

                  59B

                  MD5

                  b0eb48a7f0a6aeddc2988b4a7537e3ed

                  SHA1

                  f6a962a41cb488842090c382d50f38355d4f841b

                  SHA256

                  1b2f0b3fb664bec03f4cefb1e5eaf62a783ce23634c1b5d32d2d4be5ef43337d

                  SHA512

                  9342136bc75293ebcd5e57de754b2192605cb4ba782ae1c6519906955ff2d26cbad56804c251a7fcf8f683cb00af87839a8acc478fbc35d23791b7af0e9b4562

                • C:\Users\Admin\AppData\Local\Temp\FolderName\rundll11-.txt

                  Filesize

                  555KB

                  MD5

                  6494681c2245762c201fb9d0168a400f

                  SHA1

                  eaf39ecfb2648ac66f8e60bf63558f3d72fd9928

                  SHA256

                  e9904b7bcc2f754d895f293be21430c96f8278a449f48a346cf68036782dbfbb

                  SHA512

                  7e63b20e05fb894757505e99db8e43927e98bb5bcd0f84a5e035187536fedda5f5441711c5e22168fe59dbe5224cd7acf7836cb1e65a4dfd4b38e95dd8fce62c

                • C:\Users\Admin\AppData\Local\Temp\Sample .exe

                  Filesize

                  57KB

                  MD5

                  454501a66ad6e85175a6757573d79f8b

                  SHA1

                  8ca96c61f26a640a5b1b1152d055260b9d43e308

                  SHA256

                  7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8

                  SHA512

                  9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7

                • C:\Users\Admin\AppData\Local\Temp\Sample .exe

                  Filesize

                  57KB

                  MD5

                  454501a66ad6e85175a6757573d79f8b

                  SHA1

                  8ca96c61f26a640a5b1b1152d055260b9d43e308

                  SHA256

                  7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8

                  SHA512

                  9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7

                • C:\Users\Admin\AppData\Local\Temp\tmp.exe

                  Filesize

                  138KB

                  MD5

                  5cbe878aad90028cd68922cc9f68c944

                  SHA1

                  aea8f03a9044383ba33a032b78a266bf90e7b4ea

                  SHA256

                  6496b48f6fe928df02ed016e7d7394ff73ad111e69f8db5aaee8ff8e3e5eac38

                  SHA512

                  77a183b80d40df596f9c264eeea8ae5c28592c52da59efc31330ead3b9330f74e4ccb5c00120208b35e2fea554456bf5728b45886da13e4daefac9f8c049cf74

                • C:\Users\Admin\AppData\Local\Temp\tmp.exe

                  Filesize

                  138KB

                  MD5

                  5cbe878aad90028cd68922cc9f68c944

                  SHA1

                  aea8f03a9044383ba33a032b78a266bf90e7b4ea

                  SHA256

                  6496b48f6fe928df02ed016e7d7394ff73ad111e69f8db5aaee8ff8e3e5eac38

                  SHA512

                  77a183b80d40df596f9c264eeea8ae5c28592c52da59efc31330ead3b9330f74e4ccb5c00120208b35e2fea554456bf5728b45886da13e4daefac9f8c049cf74

                • memory/732-158-0x0000000000940000-0x00000000009B1000-memory.dmp

                  Filesize

                  452KB

                • memory/732-157-0x0000000000940000-0x00000000009B1000-memory.dmp

                  Filesize

                  452KB

                • memory/732-156-0x0000000000D00000-0x0000000000D7B000-memory.dmp

                  Filesize

                  492KB

                • memory/1352-169-0x00000000777C0000-0x00000000777CA000-memory.dmp

                  Filesize

                  40KB

                • memory/2324-168-0x00000000777C0000-0x00000000777CA000-memory.dmp

                  Filesize

                  40KB

                • memory/3068-167-0x00000000777D0000-0x0000000077973000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3068-133-0x0000000074F20000-0x00000000754D1000-memory.dmp

                  Filesize

                  5.7MB

                • memory/3068-165-0x0000000074F20000-0x00000000754D1000-memory.dmp

                  Filesize

                  5.7MB

                • memory/3068-166-0x00000000777D0000-0x0000000077973000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3068-132-0x0000000074F20000-0x00000000754D1000-memory.dmp

                  Filesize

                  5.7MB

                • memory/3508-155-0x0000000000B70000-0x0000000000BBB000-memory.dmp

                  Filesize

                  300KB

                • memory/3508-152-0x0000000002740000-0x000000000274B000-memory.dmp

                  Filesize

                  44KB

                • memory/3508-151-0x0000000000B70000-0x0000000000BBB000-memory.dmp

                  Filesize

                  300KB

                • memory/3508-150-0x0000000000B70000-0x0000000000BBB000-memory.dmp

                  Filesize

                  300KB

                • memory/3516-149-0x0000000000400000-0x0000000000426000-memory.dmp

                  Filesize

                  152KB

                • memory/3516-145-0x0000000000400000-0x0000000000426000-memory.dmp

                  Filesize

                  152KB