Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 07:56

General

  • Target

    d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465.exe

  • Size

    614KB

  • MD5

    ec1f7ae1c76bf0e00a1df1017c9b54e7

  • SHA1

    b5f31088806dc13b4031eccb2c3ccd7c258ed6f0

  • SHA256

    d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465

  • SHA512

    2c8409c7c17e22feebefe942c9f18cb698de2ce0d0b339d2448882bb23d5221a0c82c988dd70d8c3a9e836022c225649274d3ceba7fbf7f08915ddeb8edb43cf

  • SSDEEP

    12288:UYRN6Ul2gavsFJZC42Bu0aHpdjzwJ4baLN+gZPNOcmVuSR3O9cubD5:HKUl2wFJZCRBu0KA8VAnmVugubD5

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465.exe
    "C:\Users\Admin\AppData\Local\Temp\d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\n4896\s4896.exe
      "C:\Users\Admin\AppData\Local\Temp\n4896\s4896.exe" baebb1152c8fbec85149604fBsmQ7DwCn8/w5dgEpf7qVSPNOi5JHxDu/Yf6zhnVTHXlYQQTFiuuygX5IHfZrzw36M9LIcLRuH+Elos95YaPt4abiKXkU0kM9E5FMx5TDjgXHZS5WfPjxxhG0inP0bArEt+0UA9Xk2yZN7HWwsco8gO32yB13txT9CcM /v "C:\Users\Admin\AppData\Local\Temp\d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4936

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n4896\s4896.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • C:\Users\Admin\AppData\Local\Temp\n4896\s4896.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • memory/4936-138-0x00007FFB3BBF0000-0x00007FFB3C626000-memory.dmp

    Filesize

    10.2MB

  • memory/4936-139-0x000000000130A000-0x000000000130F000-memory.dmp

    Filesize

    20KB

  • memory/4936-140-0x000000000130A000-0x000000000130F000-memory.dmp

    Filesize

    20KB