Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
29/11/2022, 03:48
General
-
Target
e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f.exe
-
Size
3.7MB
-
MD5
4cfcb3953f4f41537fa5d1306f8909ba
-
SHA1
3039d358d22519f24021f53b01a511b61990505d
-
SHA256
e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f
-
SHA512
67e10cadceabcbd48deff0dbfe6ad294a3e084a64ef3f7bc25c4cfee1cf0d6ba43b8d03edeac80d12308abd4eac136174ef9abc74a86ec777b3d2b0f5d8c27ec
-
SSDEEP
98304:HYua2oT/y2oHCoAqPinoaWBxazxTrTi2O:la2kF+pO96L
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f.exe"C:\Users\Admin\AppData\Local\Temp\e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 7363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2244 -ip 22441⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD5a902beadfaeceacefb2bdf6cff750df7
SHA17da443bd9a3dc51985a4fcd8d5cbdfc4d2ae0fed
SHA25643a634019e72b71a89a9904431b538f90350cbc468c67379cfc13db8fa19c1a1
SHA5128709de4645f093598b3db692ef26b1e4fe34ead26c27e6da92d326aba70f7d3e50386d4e0359e56e0e0f88ca65f7a2a02daf0a6384462e81e9d7880d0463e464
-
Filesize
151KB
MD5a902beadfaeceacefb2bdf6cff750df7
SHA17da443bd9a3dc51985a4fcd8d5cbdfc4d2ae0fed
SHA25643a634019e72b71a89a9904431b538f90350cbc468c67379cfc13db8fa19c1a1
SHA5128709de4645f093598b3db692ef26b1e4fe34ead26c27e6da92d326aba70f7d3e50386d4e0359e56e0e0f88ca65f7a2a02daf0a6384462e81e9d7880d0463e464
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
36KB
-
Filesize
228KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
228KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
88KB
-
Filesize
88KB