Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 05:55

General

  • Target

    767f4f64e9c0010fd5451e407292511f06d89cbf1ac5c05bf62123a053ee5b8d.exe

  • Size

    614KB

  • MD5

    ef438583de39849ae1b0a41e7a19b9be

  • SHA1

    f42036a8871cca93075c4eea411b811c339da53a

  • SHA256

    767f4f64e9c0010fd5451e407292511f06d89cbf1ac5c05bf62123a053ee5b8d

  • SHA512

    854bc7c8b5762849ca74bc5be59fcf8ec38b40c7f461628305f5a7e3644db990b57901a59dfa93d49681331ce699696629e792edba5be547f4a8781327f4ec3d

  • SSDEEP

    12288:UYRN6Ul2gavsFJZC42Bu0aHpdjzwJ4baLN+gZPNOcmVuSR3O9cubDr:HKUl2wFJZCRBu0KA8VAnmVugubDr

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\767f4f64e9c0010fd5451e407292511f06d89cbf1ac5c05bf62123a053ee5b8d.exe
    "C:\Users\Admin\AppData\Local\Temp\767f4f64e9c0010fd5451e407292511f06d89cbf1ac5c05bf62123a053ee5b8d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Users\Admin\AppData\Local\Temp\n2718\s2718.exe
      "C:\Users\Admin\AppData\Local\Temp\n2718\s2718.exe" 30f7384d1ed9c6b3b15b37abfbIcL2CUZ9ldry3Vhz+Ak4p8s2UIoK25Y6PBIUtLxUiP77S2Te9fU2HpG4Vrrox2BTjUBXALxXYs+CXkVGsEF2FnG0xh2qkvUCXq1CmsPhs/3GiZsvX9nd75jIO1/IQQ5ygm0odFwhHJaky5H5ylJWzXHCP4kyGmg/Q= /v "C:\Users\Admin\AppData\Local\Temp\767f4f64e9c0010fd5451e407292511f06d89cbf1ac5c05bf62123a053ee5b8d.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1936

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n2718\s2718.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • C:\Users\Admin\AppData\Local\Temp\n2718\s2718.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • memory/1936-135-0x00007FFC2D020000-0x00007FFC2DA56000-memory.dmp

    Filesize

    10.2MB

  • memory/1936-136-0x00000000018DA000-0x00000000018DF000-memory.dmp

    Filesize

    20KB

  • memory/1936-137-0x00000000018DA000-0x00000000018DF000-memory.dmp

    Filesize

    20KB