Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    202s
  • max time network
    230s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 13:29

General

  • Target

    741e1655ad0634d317faa1270bbe3b6b6d4e0ef382c93ca408663e2b3f34d1ec.exe

  • Size

    124KB

  • MD5

    eb89ce2e91143517f4f4da72504d61a3

  • SHA1

    87a1a9af16f70aed26efecee71afc3920a4c76d8

  • SHA256

    741e1655ad0634d317faa1270bbe3b6b6d4e0ef382c93ca408663e2b3f34d1ec

  • SHA512

    51f1b76a75969ed199ca4b691818289436c0ab9c6100888ee5814d2ce2c834f3cf1b3191f3b3e272427b02aa06b9d1ba97034706627fe44133b32faa4655fa56

  • SSDEEP

    1536:e1EAhwROZuBxeDtMYHa27J14ltxporZ45iJNeG0h/x:CEAhwROZkeV6gJ1uCt45Xp

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\741e1655ad0634d317faa1270bbe3b6b6d4e0ef382c93ca408663e2b3f34d1ec.exe
    "C:\Users\Admin\AppData\Local\Temp\741e1655ad0634d317faa1270bbe3b6b6d4e0ef382c93ca408663e2b3f34d1ec.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Users\Admin\qiucih.exe
      "C:\Users\Admin\qiucih.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:116

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\qiucih.exe

    Filesize

    124KB

    MD5

    f745188ef51b2a636bebffce67a86432

    SHA1

    c4dd465f3bd820e5338526108de809a60b69bbef

    SHA256

    e3cc7b45b069435d46765b6fd97c945bb4e08b4597215f7bf2aace90834af06f

    SHA512

    40d4901e8c3b9e38c1f0d95b194419a4de2a1ff64a0bd6fe292f87eb0a54fb6fa89777ac49f060ce28bc87b9551024b0539e93fcf43676a2aba6a47efd1b05e9

  • C:\Users\Admin\qiucih.exe

    Filesize

    124KB

    MD5

    f745188ef51b2a636bebffce67a86432

    SHA1

    c4dd465f3bd820e5338526108de809a60b69bbef

    SHA256

    e3cc7b45b069435d46765b6fd97c945bb4e08b4597215f7bf2aace90834af06f

    SHA512

    40d4901e8c3b9e38c1f0d95b194419a4de2a1ff64a0bd6fe292f87eb0a54fb6fa89777ac49f060ce28bc87b9551024b0539e93fcf43676a2aba6a47efd1b05e9

  • memory/116-140-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/116-142-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2708-134-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2708-141-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB