Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    212s
  • max time network
    222s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 11:33

General

  • Target

    66459ca156058f48c2426c8e05baff34fe30a983c5e0860b7cdf64dd73e4eddf.exe

  • Size

    618KB

  • MD5

    1639054498ef55366cfcd9915de708bd

  • SHA1

    9df1eb70cb220f848e93dfac6f4e886ce492c8b6

  • SHA256

    66459ca156058f48c2426c8e05baff34fe30a983c5e0860b7cdf64dd73e4eddf

  • SHA512

    27a33d591a4d2b2272d1f322a19e1f8c83233ebc58921797f318cba507b636d5b205bb1c7461d7d8915cf6a8bf8113eb4fb96d2b9105c3dafb93da7b888bdff9

  • SSDEEP

    12288:yKfC2/WC5btCQFxZITbejP27e73Rrx8FkWIGoC3tXkg/DKWO4g8CXdpYiY+u:K2/W0NDZ/b6uumGpdXkg/DKWOj8C8iYB

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66459ca156058f48c2426c8e05baff34fe30a983c5e0860b7cdf64dd73e4eddf.exe
    "C:\Users\Admin\AppData\Local\Temp\66459ca156058f48c2426c8e05baff34fe30a983c5e0860b7cdf64dd73e4eddf.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\n5954\s5954.exe
      "C:\Users\Admin\AppData\Local\Temp\n5954\s5954.exe" c5480161bea7881fe6218f5aWhHY386lkLylMpSV2Seqv45bFceq7MqHOay19nuEfdRr2tQicXR/RmzlSP5vkL+1yAbUgrI0I5jmeYwowpWjSAS3DgYkDuMmEy7i/ayO2v8B86oOevsl9hDmnRg4BN01BCNPW2T6CmAPG1mRmZurFvL8M2B1AADe5bsAa7E= /v "C:\Users\Admin\AppData\Local\Temp\66459ca156058f48c2426c8e05baff34fe30a983c5e0860b7cdf64dd73e4eddf.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4456

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n5954\s5954.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • C:\Users\Admin\AppData\Local\Temp\n5954\s5954.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • memory/4456-135-0x00007FFE7BD90000-0x00007FFE7C7C6000-memory.dmp

    Filesize

    10.2MB