Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 14:19

General

  • Target

    85f85f52451a4386000ebb67063103742aa8648d9328ec2a4dec67428ca034ed.exe

  • Size

    419KB

  • MD5

    08693e673d23ac2c0c78b9ef8dabe218

  • SHA1

    b73cccfaf8b4f9ba7645eb8693124b637a8abf8d

  • SHA256

    85f85f52451a4386000ebb67063103742aa8648d9328ec2a4dec67428ca034ed

  • SHA512

    007a302f0a2b64d13f408f3784beca07138b6e80ae464d50e2a43bd1771292e546a68f6a13ac243feaf956ab6d9bd152505ff6e6924f3116e9abfcbcc597cac2

  • SSDEEP

    12288:VHMjpqaCqho40Vxl/RRAvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvf:dcN+Ll/RRw

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85f85f52451a4386000ebb67063103742aa8648d9328ec2a4dec67428ca034ed.exe
    "C:\Users\Admin\AppData\Local\Temp\85f85f52451a4386000ebb67063103742aa8648d9328ec2a4dec67428ca034ed.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Google Update" /XML "C:\Users\Admin\AppData\Local\Temp\aYYYYY.xml"
      2⤵
      • Creates scheduled task(s)
      PID:216
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\System32\svchost.exe"
      2⤵
        PID:4248
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1692

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\aYYYYY.xml

      Filesize

      1KB

      MD5

      edf66591eebdc49a91897516ab9c7cc3

      SHA1

      d2f119368668a3604ebbd628d31fbef39499495c

      SHA256

      ac6c76420cb4d4f8501b22992b22a082f491dd886acdb67ee4b6caf101670680

      SHA512

      4c3c1729d3347fb9abf9f8e63beaab1faeff26cd130ee823dd26403efa3fc9072f0f86f5cae27e8db2761f32f525c43fa05875eea659209c2ea3826737568773

    • memory/1692-139-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1692-136-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1692-137-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1692-138-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1692-140-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1692-142-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1692-143-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1692-145-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1692-146-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/3388-132-0x0000000074C60000-0x0000000075211000-memory.dmp

      Filesize

      5.7MB

    • memory/3388-144-0x0000000074C60000-0x0000000075211000-memory.dmp

      Filesize

      5.7MB