Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

01c7b40050...6f.exe

windows7-x64

8

01c7b40050...6f.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    176s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 11:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe

  • Size

    2.6MB

  • MD5

    c6cc0a3b77e3bd43c977ffae1eb7520e

  • SHA1

    aa6b8853a7ceb1bac762f22131917b4d5ee89142

  • SHA256

    01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f

  • SHA512

    1b18d939817330d36c1834f06d84d6fac211ea41c4e4a33d0acececfb56cd52c74fa6511031af1820379ed47e8ed5f3b4ced34973096e525341841ed2726fc97

  • SSDEEP

    49152:UJuEzDp0nzSv8EG1k3DFCZasY6DwOBfrnvV7UeWt95Z:UkEz90zyK1k3DFIYiwOBpIeWzj

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe
    "C:\Users\Admin\AppData\Local\Temp\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Users\Admin\AppData\Local\Temp\12xnccjn.i3b\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe
      "C:\Users\Admin\AppData\Local\Temp\12xnccjn.i3b\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 1912
        3⤵
        • Drops file in Windows directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:404

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\12xnccjn.i3b\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe
    Filesize

    2.2MB

    MD5

    9d42a9eaee78d72a0839150de886e922

    SHA1

    86181349fb5cf8406711c4dc36af9079af1033f2

    SHA256

    6c9c5053da6a9e80c7afe18b9436615e88dc83da972d8f893c3b117dd5c471fb

    SHA512

    0f28a36033a7b68737fe03fedaa01184739ee76a0866ad25457fe873edd5e9d8d2d960485273c556bfd6ee7a91620b0217b07bfd1a2f14c822622492da73e7e9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\12xnccjn.i3b\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe
    Filesize

    2.2MB

    MD5

    9d42a9eaee78d72a0839150de886e922

    SHA1

    86181349fb5cf8406711c4dc36af9079af1033f2

    SHA256

    6c9c5053da6a9e80c7afe18b9436615e88dc83da972d8f893c3b117dd5c471fb

    SHA512

    0f28a36033a7b68737fe03fedaa01184739ee76a0866ad25457fe873edd5e9d8d2d960485273c556bfd6ee7a91620b0217b07bfd1a2f14c822622492da73e7e9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\12xnccjn.i3b\icon
    Filesize

    136KB

    MD5

    77065ce9dd4b539fd4089a2a20cda46a

    SHA1

    18b39de47e4d7bb2e80c9315762b61998aecf75d

    SHA256

    1210adab883503cc8670e0725aea3e6105c70d555c50dcc3385895c6a856852f

    SHA512

    9b5417122da042f75f1b7d43da12c8a253e634c2356ec0efb90cde344b8fdba4c03b16c6eb04a166b47c6c78f43d358145683ee538caec939cf6550e1a4c4e09

    Download Submit

  • memory/2256-137-0x0000000074E10000-0x00000000753C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2256-138-0x0000000074E10000-0x00000000753C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2256-141-0x0000000074E10000-0x00000000753C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4900-132-0x0000000074E10000-0x00000000753C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4900-136-0x0000000074E10000-0x00000000753C1000-memory.dmp

    Filesize

    5.7MB

    Download