Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
188s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
Resource
win10v2004-20220812-en
General
-
Target
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
-
Size
353KB
-
MD5
482984489450e7e582492ebb6f8743e6
-
SHA1
82155522f5b61b90dd5700c2365f4d1b4125ec11
-
SHA256
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b
-
SHA512
be01d761ece0d3b00634031be6773b5dfd543f5a0c427bf3b94645503bc5c98672db65c619e96fa16903e169e299352e176b5ec731fd2852494a7c88b874ee01
-
SSDEEP
6144:qK7hBDO7gNSXo551EgMOK/Vmju+MokGwiquFeoQ3z3T4Qmw:rTO7gNN556gcuu+MokvMevz38w
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0008000000022e27-134.dat acprotect behavioral2/files/0x0008000000022e27-133.dat acprotect behavioral2/files/0x0006000000022e3c-139.dat acprotect behavioral2/files/0x0006000000022e3c-140.dat acprotect behavioral2/files/0x0008000000022e27-143.dat acprotect behavioral2/files/0x0008000000022e27-142.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 752 tyhhyg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe -
Loads dropped DLL 5 IoCs
pid Process 4856 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 4856 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 752 tyhhyg.exe 752 tyhhyg.exe 3772 WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\tyhhyg.exe" b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tyhhyg.exe b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe File created C:\Windows\SysWOW64\tyhhyg.exe b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4856 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 752 tyhhyg.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4856 wrote to memory of 3772 4856 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 80 PID 4856 wrote to memory of 3772 4856 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 80 PID 4856 wrote to memory of 3772 4856 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe"C:\Users\Admin\AppData\Local\Temp\b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\1208.vbs"2⤵
- Loads dropped DLL
PID:3772
-
-
C:\Windows\SysWOW64\tyhhyg.exeC:\Windows\SysWOW64\tyhhyg.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500B
MD5dcfde6e1d6f24353f610ac599052525c
SHA1cb3c45661f9d709535b33d5ad173fb3b3dfab389
SHA2562181025e2a0c0bee674408ea13e6bf3cf862203662d72f4d0f70f08da5d1dc30
SHA5125943f3464793e48a346ddc1fc4aeee62d0beb58567d57ad4ce07d695d00a98eabe02a986440eb04c0b182e2799721de533143f0fb72646326b01e8c9e1ef0e95
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
353KB
MD5482984489450e7e582492ebb6f8743e6
SHA182155522f5b61b90dd5700c2365f4d1b4125ec11
SHA256b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b
SHA512be01d761ece0d3b00634031be6773b5dfd543f5a0c427bf3b94645503bc5c98672db65c619e96fa16903e169e299352e176b5ec731fd2852494a7c88b874ee01
-
Filesize
353KB
MD5482984489450e7e582492ebb6f8743e6
SHA182155522f5b61b90dd5700c2365f4d1b4125ec11
SHA256b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b
SHA512be01d761ece0d3b00634031be6773b5dfd543f5a0c427bf3b94645503bc5c98672db65c619e96fa16903e169e299352e176b5ec731fd2852494a7c88b874ee01
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9