Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    247s
  • max time network
    272s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 00:16

General

  • Target

    a0d777aca98a1d194a1fe771ed0c119e38412b5370cc7a8782587d371b823c4b.exe

  • Size

    924KB

  • MD5

    32773e7b7b63ed06db0f45388e860723

  • SHA1

    f6dfd607be4e41deda9751294ff0095ce5094ce0

  • SHA256

    a0d777aca98a1d194a1fe771ed0c119e38412b5370cc7a8782587d371b823c4b

  • SHA512

    8f267776d0cf77704ca2110ca0f0b86b72d1e121ae9116ee6db4fb1b61338120be96bc1db6f21d1e99f5e562c65f9714ca6568bc46c1519b9f8f82c3cd229b32

  • SSDEEP

    24576:x+xyXMK/7zMJ+NnzwlcRMlvHrzLePhyfKPHgJ:4STzMJ4wlnlTz6PhyfK4J

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0d777aca98a1d194a1fe771ed0c119e38412b5370cc7a8782587d371b823c4b.exe
    "C:\Users\Admin\AppData\Local\Temp\a0d777aca98a1d194a1fe771ed0c119e38412b5370cc7a8782587d371b823c4b.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4072
    • C:\Users\Admin\AppData\Local\Temp\Xbox 360 1 Generator.exe
      "C:\Users\Admin\AppData\Local\Temp\Xbox 360 1 Generator.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4828
    • C:\Users\Admin\AppData\Local\Temp\a0d777aca98a1d194a1fe771ed0c119e38412b5370cc7a8782587d371b823c4b.exe
      C:\Users\Admin\AppData\Local\Temp\a0d777aca98a1d194a1fe771ed0c119e38412b5370cc7a8782587d371b823c4b.exe ""
      2⤵
        PID:4824

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Xbox 360 1 Generator.exe

      Filesize

      400KB

      MD5

      4fb928be9763d8ec07b5640b106004c8

      SHA1

      ce50259733c4133adcb179213809d22593af9ceb

      SHA256

      4837b08c1a07db4a2acff556b962a5a427e3925879857739709f7f36481cddc9

      SHA512

      ed2a6dc12cae4f6d032be89908bc616315608e43843c3942cf0e449039e2d6960f8adfe0a40e0c21d7cb0cf9fd6fa9c5d9e9543927ea73f47d6e0392bc75c9b6

    • C:\Users\Admin\AppData\Local\Temp\Xbox 360 1 Generator.exe

      Filesize

      400KB

      MD5

      4fb928be9763d8ec07b5640b106004c8

      SHA1

      ce50259733c4133adcb179213809d22593af9ceb

      SHA256

      4837b08c1a07db4a2acff556b962a5a427e3925879857739709f7f36481cddc9

      SHA512

      ed2a6dc12cae4f6d032be89908bc616315608e43843c3942cf0e449039e2d6960f8adfe0a40e0c21d7cb0cf9fd6fa9c5d9e9543927ea73f47d6e0392bc75c9b6

    • memory/4072-132-0x0000000000400000-0x00000000004FD000-memory.dmp

      Filesize

      1012KB

    • memory/4072-135-0x0000000000400000-0x00000000004FD000-memory.dmp

      Filesize

      1012KB

    • memory/4072-146-0x0000000000400000-0x00000000004FD000-memory.dmp

      Filesize

      1012KB

    • memory/4824-142-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4824-143-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4824-144-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4824-145-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4824-147-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB