Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28/11/2022, 03:12
General
-
Target
ad5c44320fb2c6dc5abf04c34bb42cab878a6edb2dde013af15e18672b49714c.exe
-
Size
191KB
-
MD5
3469e036c539de4e980aac7efc4ece27
-
SHA1
55fb0276622b4c187f22f0925b38465278232f10
-
SHA256
ad5c44320fb2c6dc5abf04c34bb42cab878a6edb2dde013af15e18672b49714c
-
SHA512
3c94ef88de4e5b9fc1f57a92f30f46ae1748996d17476f15e5f0762e9507b67c9ea36fae0edb7872737a0ef65a5a252355d458368429fe23b6b09077a3101c99
-
SSDEEP
3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0d1:HAVySV1eY4k437d+4wkTHdS2t
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad5c44320fb2c6dc5abf04c34bb42cab878a6edb2dde013af15e18672b49714c.exe"C:\Users\Admin\AppData\Local\Temp\ad5c44320fb2c6dc5abf04c34bb42cab878a6edb2dde013af15e18672b49714c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx