Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
69s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/12/2022, 05:40
Static task
static1
Behavioral task
behavioral1
Sample
271ef5958de8bdbf6d300b9a95512a9079212ab14406c2feb7a4a00f0517ed6f.exe
Resource
win10-20220812-en
General
-
Target
271ef5958de8bdbf6d300b9a95512a9079212ab14406c2feb7a4a00f0517ed6f.exe
-
Size
1.7MB
-
MD5
e6e33f5a4505a189fb5873ee9edb719f
-
SHA1
318fdf4c13981fbbf87a4d1f3eeadf1cef8f1bbb
-
SHA256
271ef5958de8bdbf6d300b9a95512a9079212ab14406c2feb7a4a00f0517ed6f
-
SHA512
fba1f864120af6bee2ac78d32df08f36b4db94ac3e44859bed6fa35deb846f83b7b8c9a469d215bf6a86a553abfa07c9642ef4cd93fa0896a202c513b84a5630
-
SSDEEP
49152:VJ4oSJrYpv5LqV0E6LaXQttdR8c2ZN956R:VJ4eVqV0rwktCN956R
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2880 rundll32.exe 2880 rundll32.exe 5004 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2448 wrote to memory of 4720 2448 271ef5958de8bdbf6d300b9a95512a9079212ab14406c2feb7a4a00f0517ed6f.exe 66 PID 2448 wrote to memory of 4720 2448 271ef5958de8bdbf6d300b9a95512a9079212ab14406c2feb7a4a00f0517ed6f.exe 66 PID 2448 wrote to memory of 4720 2448 271ef5958de8bdbf6d300b9a95512a9079212ab14406c2feb7a4a00f0517ed6f.exe 66 PID 4720 wrote to memory of 2880 4720 control.exe 67 PID 4720 wrote to memory of 2880 4720 control.exe 67 PID 4720 wrote to memory of 2880 4720 control.exe 67 PID 2880 wrote to memory of 4844 2880 rundll32.exe 68 PID 2880 wrote to memory of 4844 2880 rundll32.exe 68 PID 4844 wrote to memory of 5004 4844 RunDll32.exe 69 PID 4844 wrote to memory of 5004 4844 RunDll32.exe 69 PID 4844 wrote to memory of 5004 4844 RunDll32.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\271ef5958de8bdbf6d300b9a95512a9079212ab14406c2feb7a4a00f0517ed6f.exe"C:\Users\Admin\AppData\Local\Temp\271ef5958de8bdbf6d300b9a95512a9079212ab14406c2feb7a4a00f0517ed6f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" .\Y1C7.3TW2⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\Y1C7.3TW3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\Y1C7.3TW4⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\Y1C7.3TW5⤵
- Loads dropped DLL
PID:5004
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54d522a0946e8606db4d0b787827a0f38
SHA16d77e4382d3bd5cbdb671ace87db3975a84691ae
SHA256984072d8020bb3670545ba91f19bd3ac856601570d88edeb5aaf67fa58d953b3
SHA5123d9888c05690015ab22dbc7d7586295882c9f379662175ecba8c0ed26168b45cff3af80d37102a5b1596a0588b2ad4fa52a04453d75d4be4485a7c2e0eb65efb
-
Filesize
1.6MB
MD54d522a0946e8606db4d0b787827a0f38
SHA16d77e4382d3bd5cbdb671ace87db3975a84691ae
SHA256984072d8020bb3670545ba91f19bd3ac856601570d88edeb5aaf67fa58d953b3
SHA5123d9888c05690015ab22dbc7d7586295882c9f379662175ecba8c0ed26168b45cff3af80d37102a5b1596a0588b2ad4fa52a04453d75d4be4485a7c2e0eb65efb
-
Filesize
1.6MB
MD54d522a0946e8606db4d0b787827a0f38
SHA16d77e4382d3bd5cbdb671ace87db3975a84691ae
SHA256984072d8020bb3670545ba91f19bd3ac856601570d88edeb5aaf67fa58d953b3
SHA5123d9888c05690015ab22dbc7d7586295882c9f379662175ecba8c0ed26168b45cff3af80d37102a5b1596a0588b2ad4fa52a04453d75d4be4485a7c2e0eb65efb
-
Filesize
1.6MB
MD54d522a0946e8606db4d0b787827a0f38
SHA16d77e4382d3bd5cbdb671ace87db3975a84691ae
SHA256984072d8020bb3670545ba91f19bd3ac856601570d88edeb5aaf67fa58d953b3
SHA5123d9888c05690015ab22dbc7d7586295882c9f379662175ecba8c0ed26168b45cff3af80d37102a5b1596a0588b2ad4fa52a04453d75d4be4485a7c2e0eb65efb