Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
IMG001.scr
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
IMG001.scr
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
information.vbe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
information.vbe
Resource
win10v2004-20220812-en
General
-
Target
IMG001.scr
-
Size
3.4MB
-
MD5
fbbcf1e9501234d6661a0c9ae6dc01c9
-
SHA1
1ca9759a324159f331e79ea6871ad62040521b41
-
SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
-
SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140
-
SSDEEP
98304:M5VPnq1y5tQOM33ZNqCtBixHl54Oyjes1Ro6:2VPq1yLanrqTr43eON
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2120 IMG001.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation IMG001.scr Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation IMG001.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk IMG001.exe -
Loads dropped DLL 3 IoCs
pid Process 2120 IMG001.exe 2120 IMG001.exe 2120 IMG001.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe" IMG001.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run IMG001.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: IMG001.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\UAC.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x0008000000022f63-133.dat nsis_installer_1 behavioral2/files/0x0008000000022f63-133.dat nsis_installer_2 behavioral2/files/0x0008000000022f63-134.dat nsis_installer_1 behavioral2/files/0x0008000000022f63-134.dat nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1800 schtasks.exe 4052 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 1772 powercfg.exe Token: SeCreatePagefilePrivilege 1772 powercfg.exe Token: SeShutdownPrivilege 1340 powercfg.exe Token: SeCreatePagefilePrivilege 1340 powercfg.exe Token: SeShutdownPrivilege 5116 powercfg.exe Token: SeCreatePagefilePrivilege 5116 powercfg.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4660 wrote to memory of 2120 4660 IMG001.scr 78 PID 4660 wrote to memory of 2120 4660 IMG001.scr 78 PID 4660 wrote to memory of 2120 4660 IMG001.scr 78 PID 2120 wrote to memory of 2064 2120 IMG001.exe 81 PID 2120 wrote to memory of 2064 2120 IMG001.exe 81 PID 2120 wrote to memory of 2064 2120 IMG001.exe 81 PID 2120 wrote to memory of 1256 2120 IMG001.exe 82 PID 2120 wrote to memory of 1256 2120 IMG001.exe 82 PID 2120 wrote to memory of 1256 2120 IMG001.exe 82 PID 2120 wrote to memory of 1492 2120 IMG001.exe 83 PID 2120 wrote to memory of 1492 2120 IMG001.exe 83 PID 2120 wrote to memory of 1492 2120 IMG001.exe 83 PID 2120 wrote to memory of 1836 2120 IMG001.exe 84 PID 2120 wrote to memory of 1836 2120 IMG001.exe 84 PID 2120 wrote to memory of 1836 2120 IMG001.exe 84 PID 1836 wrote to memory of 1772 1836 cmd.exe 89 PID 1836 wrote to memory of 1772 1836 cmd.exe 89 PID 1836 wrote to memory of 1772 1836 cmd.exe 89 PID 2064 wrote to memory of 2884 2064 cmd.exe 90 PID 2064 wrote to memory of 2884 2064 cmd.exe 90 PID 2064 wrote to memory of 2884 2064 cmd.exe 90 PID 1256 wrote to memory of 1800 1256 cmd.exe 91 PID 1256 wrote to memory of 1800 1256 cmd.exe 91 PID 1256 wrote to memory of 1800 1256 cmd.exe 91 PID 1492 wrote to memory of 4052 1492 cmd.exe 92 PID 1492 wrote to memory of 4052 1492 cmd.exe 92 PID 1492 wrote to memory of 4052 1492 cmd.exe 92 PID 1836 wrote to memory of 1340 1836 cmd.exe 93 PID 1836 wrote to memory of 1340 1836 cmd.exe 93 PID 1836 wrote to memory of 1340 1836 cmd.exe 93 PID 1836 wrote to memory of 5116 1836 cmd.exe 94 PID 1836 wrote to memory of 5116 1836 cmd.exe 94 PID 1836 wrote to memory of 5116 1836 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG001.scr"C:\Users\Admin\AppData\Local\Temp\IMG001.scr" /S1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ3⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ4⤵
- Adds Run key to start application
PID:2884
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"4⤵
- Creates scheduled task(s)
PID:1800
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4052
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0003⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340
-
-
C:\Windows\SysWOW64\powercfg.exePowercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0004⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5d7a3fa6a6c738b4a3c40d5602af20b08
SHA134fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA25667eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
SHA51275cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
-
Filesize
21KB
MD5d7a3fa6a6c738b4a3c40d5602af20b08
SHA134fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA25667eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
SHA51275cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
-
Filesize
21KB
MD5d7a3fa6a6c738b4a3c40d5602af20b08
SHA134fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA25667eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
SHA51275cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
-
Filesize
3.4MB
MD5fbbcf1e9501234d6661a0c9ae6dc01c9
SHA11ca9759a324159f331e79ea6871ad62040521b41
SHA256d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
SHA512027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140
-
Filesize
3.4MB
MD5fbbcf1e9501234d6661a0c9ae6dc01c9
SHA11ca9759a324159f331e79ea6871ad62040521b41
SHA256d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
SHA512027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140