Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    84s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 06:31

General

  • Target

    855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe

  • Size

    90KB

  • MD5

    115cb19644cf409c7f9558411736fb56

  • SHA1

    3f10bbb62f0f9e9b26e5b9dd5f26700b3df800be

  • SHA256

    855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e

  • SHA512

    2ad5984bee010bd2447a4da9a22ff6c0ecff21349c84f51772f4e290e99fe604b5ecec4a870d2ba5e46664734806ddc541dcaec6605d416165557c45cc600cf4

  • SSDEEP

    1536:5ofZjoekm2T0XepZnvxEO0HMFBx4qWxzNJjCryG/ZHW9rC38tnsTvYsqbssX:5oxjodUezv6/kx4XNJjCryGBHm1tdsM

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe
    "C:\Users\Admin\AppData\Local\Temp\855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4312

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nspE0E1.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    51e7fd0885b7d7bf6edc030e17145950

    SHA1

    be7a62d254f897789cde5b9a77a8b3b0add6d141

    SHA256

    1a56dfe0bdae779b40d11b9caee5c96e81b9d69b0d45be7c7b11717e1db8c5a5

    SHA512

    a57c57a3d01839df10ab669bead1d757ef85e4a35cac65a3a147c5e1adaccaae52bb355ed8d4d460a6698cbda3ee8fba395875739670c8cf57884f66306d011a

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    90KB

    MD5

    115cb19644cf409c7f9558411736fb56

    SHA1

    3f10bbb62f0f9e9b26e5b9dd5f26700b3df800be

    SHA256

    855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e

    SHA512

    2ad5984bee010bd2447a4da9a22ff6c0ecff21349c84f51772f4e290e99fe604b5ecec4a870d2ba5e46664734806ddc541dcaec6605d416165557c45cc600cf4

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    90KB

    MD5

    115cb19644cf409c7f9558411736fb56

    SHA1

    3f10bbb62f0f9e9b26e5b9dd5f26700b3df800be

    SHA256

    855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e

    SHA512

    2ad5984bee010bd2447a4da9a22ff6c0ecff21349c84f51772f4e290e99fe604b5ecec4a870d2ba5e46664734806ddc541dcaec6605d416165557c45cc600cf4