Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe
-
Size
215KB
-
MD5
641f009217ca4ef89260144580128307
-
SHA1
b1fc44d99d75305a6759fa0b52a45fa8f5e6ca9f
-
SHA256
ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0
-
SHA512
0329285e93110803f17f3f32663f9c5a4adaca7aa913c6c36505ae382a5df248d4852138588144896a1a304e5db0e2b7a2a8b141a37a44660fcfef735a482c7a
-
SSDEEP
3072:6x4EpZeqcBtxOZqPHkykypEo2D/KcgftkHdGlOKgdQ0ZahiMopLdQiRjbcZeM3L6:KJTAxOGHkjV/MkHdEkoiDX/cMMm
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1952-133-0x0000000000400000-0x0000000000490000-memory.dmp upx behavioral2/memory/644-134-0x0000000000400000-0x0000000000490000-memory.dmp upx behavioral2/memory/644-135-0x0000000000400000-0x0000000000490000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\J0OYo3]r+G J0OYo3]r+G.exe File opened for modification C:\PROGRA~3\J0OYo3]r+G J0OYo3]r+G.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 J0OYo3]r+G.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString J0OYo3]r+G.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" J0OYo3]r+G.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Download J0OYo3]r+G.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" J0OYo3]r+G.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main J0OYo3]r+G.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1952 ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 644 J0OYo3]r+G.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1952 ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe 644 J0OYo3]r+G.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1952 wrote to memory of 644 1952 ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe 83 PID 1952 wrote to memory of 644 1952 ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe 83 PID 1952 wrote to memory of 644 1952 ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe"C:\Users\Admin\AppData\Local\Temp\ef13ca7439d86e91c855899b724aca8e14ecaffa21c8cf80e5aac84b602c3ab0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\PROGRA~3\J0OYo3]r+G.exeC:\PROGRA~3\J0OYo3]r+G.exe2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:644
-