Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 12:43
Behavioral task
behavioral1
Sample
bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe
Resource
win10v2004-20221111-en
General
-
Target
bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe
-
Size
48KB
-
MD5
944cf0d89b9b2da4fbc38dda1801d3ce
-
SHA1
8d648dcecbca9e71ea80802019777f32233dd014
-
SHA256
bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5
-
SHA512
1073c6d75779f3d6b59e3d3f01589822750d0f8191e8b3bb0ed46170b46ea2675b00eb9be594a0dd0602664d1454cba0cc51f14f8db19d80db3d43c1f7c65a9e
-
SSDEEP
768:BZ6DFma8K6HC4kj5Jp9jrQOV/W4jcAFVLymH6SKd3j8oi4p6bxuc:+FSHHzgJL5V/Wec4OmaSs8M6P
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2068 SMSvchost.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvchost\Parameters\ServiceDll = "C:\\Program Files (x86)\\Google\\240559265.dll" bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe -
Loads dropped DLL 3 IoCs
pid Process 4520 bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe 2480 svchost.exe 2068 SMSvchost.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SMSvchost.exe svchost.exe File opened for modification C:\Windows\SysWOW64\SMSvchost.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Google\240559265.dll bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4168 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4520 bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe 4520 bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4520 bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4520 bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2068 2480 svchost.exe 85 PID 2480 wrote to memory of 2068 2480 svchost.exe 85 PID 2480 wrote to memory of 2068 2480 svchost.exe 85 PID 4520 wrote to memory of 1200 4520 bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe 88 PID 4520 wrote to memory of 1200 4520 bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe 88 PID 4520 wrote to memory of 1200 4520 bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe 88 PID 1200 wrote to memory of 4168 1200 cmd.exe 90 PID 1200 wrote to memory of 4168 1200 cmd.exe 90 PID 1200 wrote to memory of 4168 1200 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe"C:\Users\Admin\AppData\Local\Temp\bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe"1⤵
- Sets DLL path for service in the registry
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\bef142fcb708afbcf512688a5bc0e63fc91fb2d3adb09634fededb55c70925b5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:4168
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "SMSvchost"1⤵PID:2880
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "SMSvchost"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\SMSvchost.exeC:\Windows\system32\SMSvchost.exe "c:\program files (x86)\google\240559265.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD5178587de46a06ff36cd326ce1860ecf3
SHA18e207a833fb7984b7cea03cb7f7634a67a4ca699
SHA256df7d74a16b6d6c3ca5a2600f4288a266e4a5bd2613738482dafff1840d4a203a
SHA512c191cfd7c3189e1a6032d4d6bbd6fd22579975e3fb0b2c509863807b320a26404bc70b71dd94f697b3b22403d68f4f3bb4f7c933c56091df5da2787262286e71
-
Filesize
26KB
MD5178587de46a06ff36cd326ce1860ecf3
SHA18e207a833fb7984b7cea03cb7f7634a67a4ca699
SHA256df7d74a16b6d6c3ca5a2600f4288a266e4a5bd2613738482dafff1840d4a203a
SHA512c191cfd7c3189e1a6032d4d6bbd6fd22579975e3fb0b2c509863807b320a26404bc70b71dd94f697b3b22403d68f4f3bb4f7c933c56091df5da2787262286e71
-
Filesize
26KB
MD5178587de46a06ff36cd326ce1860ecf3
SHA18e207a833fb7984b7cea03cb7f7634a67a4ca699
SHA256df7d74a16b6d6c3ca5a2600f4288a266e4a5bd2613738482dafff1840d4a203a
SHA512c191cfd7c3189e1a6032d4d6bbd6fd22579975e3fb0b2c509863807b320a26404bc70b71dd94f697b3b22403d68f4f3bb4f7c933c56091df5da2787262286e71
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
26KB
MD5178587de46a06ff36cd326ce1860ecf3
SHA18e207a833fb7984b7cea03cb7f7634a67a4ca699
SHA256df7d74a16b6d6c3ca5a2600f4288a266e4a5bd2613738482dafff1840d4a203a
SHA512c191cfd7c3189e1a6032d4d6bbd6fd22579975e3fb0b2c509863807b320a26404bc70b71dd94f697b3b22403d68f4f3bb4f7c933c56091df5da2787262286e71