Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe
Resource
win10v2004-20220901-en
General
-
Target
547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe
-
Size
4.6MB
-
MD5
b732e893505b753a9c2d8bdb16bce4a0
-
SHA1
8eda3b9dae91d58e9c6fd36d923319c755df91ca
-
SHA256
547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422
-
SHA512
c6cfaaf2d504f60f8c799613bcad3023a974412670874c4d48f909d2245791bbccff69348e4e6a5c9f7a32dae5ecbfe9cceec3e8836d24fa62970732d0ca68ae
-
SSDEEP
98304:i1WVabJDxrp6S6elUavr28/gpjFOQ6LxLZa6Sjy+58Rq:UAabJDzD68EOd7u2+5Mq
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4640 Tempps.exe 3352 Tempps.tmp -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2312 wrote to memory of 4640 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 82 PID 2312 wrote to memory of 4640 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 82 PID 2312 wrote to memory of 4640 2312 547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe 82 PID 4640 wrote to memory of 3352 4640 Tempps.exe 83 PID 4640 wrote to memory of 3352 4640 Tempps.exe 83 PID 4640 wrote to memory of 3352 4640 Tempps.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe"C:\Users\Admin\AppData\Local\Temp\547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Tempps.exe"C:\Users\Admin\AppData\Local\Tempps.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\is-O6276.tmp\Tempps.tmp"C:\Users\Admin\AppData\Local\Temp\is-O6276.tmp\Tempps.tmp" /SL5="$40090,4379801,140800,C:\Users\Admin\AppData\Local\Tempps.exe"3⤵
- Executes dropped EXE
PID:3352
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5b277e6ac242fcbc37f4d03e1528949c1
SHA12602407044a6bad216d3856eaf8fb990e0f1094f
SHA2569461ae8a13a57c0d8490916dc1e1bb20cb0c171b9852d0846a03c4c4d212f204
SHA51280d8b934ff63e4a7df3dabb9e6435c2d5ea542624b238be8a27b53c63be8dc244d46d4d9db1950b6d67d91dde12f3d819e7e4453536595d6385c65d2c6bbf5f7
-
Filesize
1.1MB
MD5b277e6ac242fcbc37f4d03e1528949c1
SHA12602407044a6bad216d3856eaf8fb990e0f1094f
SHA2569461ae8a13a57c0d8490916dc1e1bb20cb0c171b9852d0846a03c4c4d212f204
SHA51280d8b934ff63e4a7df3dabb9e6435c2d5ea542624b238be8a27b53c63be8dc244d46d4d9db1950b6d67d91dde12f3d819e7e4453536595d6385c65d2c6bbf5f7
-
Filesize
4.6MB
MD53cd222f47bf2de25c721fd8b1fa965e0
SHA1d5b087759639020ad5d8d900145efe978e80eadd
SHA256c8cb41f7f9db8f764daf601f7f56daf9514eede1e1d42e4039492663e7dc8171
SHA5125a13be5a7a1a871eaf7ca8ecb7659cb3c5e90657752baae80026abf607dc93fdac45069631aae1f8ac6a43968adcdfb4df4f591911258e59a1a47219cdde5193
-
Filesize
4.6MB
MD53cd222f47bf2de25c721fd8b1fa965e0
SHA1d5b087759639020ad5d8d900145efe978e80eadd
SHA256c8cb41f7f9db8f764daf601f7f56daf9514eede1e1d42e4039492663e7dc8171
SHA5125a13be5a7a1a871eaf7ca8ecb7659cb3c5e90657752baae80026abf607dc93fdac45069631aae1f8ac6a43968adcdfb4df4f591911258e59a1a47219cdde5193