Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe
-
Size
183KB
-
MD5
cb2d856dc72bb7e528dba68f19e8fdca
-
SHA1
39a48d86e280a65d35bec591776816358b8372e3
-
SHA256
addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304
-
SHA512
476009a3a16183a47aa0e02d8fcfea357693f3e67657ebd9f8a5781c054accf02b937555c84a5539f9702a3a81ae48d6a27283dad0790afaa90e90623180bf27
-
SSDEEP
3072:q/SpcwdFVhNPN1e68NpDUdI9BTX/EOWm1LUABC/74n8snQXkoemxhCh8llgQWZR:q/0FVhNPNMrUITTvosLUAg8n8MQz/cGG
Score
10/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\IsShortcut PPStream.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\lnkfile\IsShortcut PPStream.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\IsShortcut addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\lnkfile\IsShortcut addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe -
Executes dropped EXE 1 IoCs
pid Process 3596 PPStream.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WinPcap\TempWord.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempWindows PowerShell (x86).lnk PPStream.exe File created C:\Program Files\WinPcap\Wordpad.lnk PPStream.exe File created C:\Program Files\WinPcap\TempConfigure Java.lnk PPStream.exe File created C:\Program Files\WinPcap\TempPaint.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempWordpad.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Office Language Preferences.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\PowerPoint.lnk PPStream.exe File created C:\Program Files\WinPcap\TempAcrobat Reader DC.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Windows PowerShell.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Notepad.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\iSCSI Initiator.lnk PPStream.exe File created C:\Program Files\WinPcap\ODBC Data Sources (64-bit).lnk PPStream.exe File created C:\Program Files\WinPcap\TempAdministrative Tools.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempMath Input Panel.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Immersive Control Panel.lnk PPStream.exe File created C:\Program Files\WinPcap\TempMagnify.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Excel.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Wordpad.lnk PPStream.exe File created C:\Program Files\WinPcap\dfrgui.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Registry Editor.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempSystem Configuration.lnk PPStream.exe File created C:\Program Files\WinPcap\TempWord.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Character Map.lnk PPStream.exe File created C:\Program Files\WinPcap\Registry Editor.lnk PPStream.exe File created C:\Program Files\WinPcap\TempAbout Java.lnk PPStream.exe File created C:\Program Files\WinPcap\PPStream.exe addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe File opened for modification C:\Program Files\WinPcap\Speech Recognition.lnk PPStream.exe File created C:\Program Files\WinPcap\TempNotepad.lnk PPStream.exe File created C:\Program Files\WinPcap\TempWindows Media Player.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\config.ini PPStream.exe File opened for modification C:\Program Files\WinPcap\Windows Media Player.lnk PPStream.exe File created C:\Program Files\WinPcap\TempMath Input Panel.lnk PPStream.exe File created C:\Program Files\WinPcap\Acrobat Reader DC.lnk PPStream.exe File created C:\Program Files\WinPcap\TempCommand Prompt.lnk PPStream.exe File created C:\Program Files\WinPcap\Disk Cleanup.lnk PPStream.exe File created C:\Program Files\WinPcap\Telemetry Dashboard for Office.lnk PPStream.exe File created C:\Program Files\WinPcap\Office Upload Center.lnk PPStream.exe File created C:\Program Files\WinPcap\TempImmersive Control Panel.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Word.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Magnify.lnk PPStream.exe File created C:\Program Files\WinPcap\Steps Recorder.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempQuick Assist.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\dfrgui.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempWindows PowerShell ISE.lnk PPStream.exe File created C:\Program Files\WinPcap\TempSpeech Recognition.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempDisk Cleanup.lnk PPStream.exe File created C:\Program Files\WinPcap\TempSystem Configuration.lnk PPStream.exe File created C:\Program Files\WinPcap\Microsoft Edge.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempVLC media player skinned.lnk PPStream.exe File created C:\Program Files\WinPcap\Notepad.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempConfigure Java.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\VLC media player skinned.lnk PPStream.exe File created C:\Program Files\WinPcap\ODBC Data Sources (32-bit).lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Remote Desktop Connection.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Telemetry Dashboard for Office.lnk PPStream.exe File created C:\Program Files\WinPcap\On-Screen Keyboard.lnk PPStream.exe File created C:\Program Files\WinPcap\TempSpreadsheet Compare.lnk PPStream.exe File created C:\Program Files\WinPcap\Check For Updates.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\Acrobat Reader DC.lnk PPStream.exe File created C:\Program Files\WinPcap\Magnify.lnk PPStream.exe File opened for modification C:\Program Files\WinPcap\TempExcel.lnk PPStream.exe File created C:\Program Files\WinPcap\Snipping Tool.lnk PPStream.exe File created C:\Program Files\WinPcap\TempExcel.lnk PPStream.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\IsShortcut addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\lnkfile\IsShortcut addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\IsShortcut PPStream.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\lnkfile\IsShortcut PPStream.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3596 PPStream.exe 3596 PPStream.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3596 PPStream.exe 3596 PPStream.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4424 wrote to memory of 3596 4424 addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe 81 PID 4424 wrote to memory of 3596 4424 addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe 81 PID 4424 wrote to memory of 3596 4424 addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe"C:\Users\Admin\AppData\Local\Temp\addaf659dde6e480b982b66999398d52c1bf2dbf751c1ec9280bf98cff615304.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Program Files\WinPcap\PPStream.exe"C:\Program Files\WinPcap\PPStream.exe"2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3596
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5708f12015aae0abf73ab11f8ffc2a739
SHA1534f3c411937ebe6f135a6ab3b100d9f6c283a0a
SHA2560f5093286ca1048a6d13f277c11c23a37dbb494aaa8ca190fd27f80c4c14c881
SHA512efbc5c6357609c95d373a1e53bd52a2fbee867fd3cd7e137396edb3bf1a3bf84a14801543d681446526d7cb3f7887f7b9d7494799e855153314fb16307b92ac2
-
Filesize
6.6MB
MD5708f12015aae0abf73ab11f8ffc2a739
SHA1534f3c411937ebe6f135a6ab3b100d9f6c283a0a
SHA2560f5093286ca1048a6d13f277c11c23a37dbb494aaa8ca190fd27f80c4c14c881
SHA512efbc5c6357609c95d373a1e53bd52a2fbee867fd3cd7e137396edb3bf1a3bf84a14801543d681446526d7cb3f7887f7b9d7494799e855153314fb16307b92ac2