Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 12:20
Behavioral task
behavioral1
Sample
d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe
-
Size
104KB
-
MD5
0048132d20458357ab199ca8d061b284
-
SHA1
28abb097c18837f3437e65ab8ebb90989b3b24b0
-
SHA256
d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558
-
SHA512
983fd749db6628e6632c717596f0d06a1c26a77e30e817ef404f8d649955a970b14555f9397464fe37f5cdf55deb338b20d69736854a1b32d4077a86d5221d02
-
SSDEEP
3072:uetDOSpgJremwXSAvNdH1w4IqeolDHXOMxiU:2Spgxem/4NbTIq9D3Vxi
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1648 trys.exe 3520 trys.exe 3904 trys.exe -
resource yara_rule behavioral2/memory/4840-134-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4364-136-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4364-139-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4840-140-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4364-138-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4364-143-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4364-147-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0007000000022e71-149.dat upx behavioral2/files/0x0007000000022e71-150.dat upx behavioral2/memory/1648-153-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/files/0x0007000000022e71-156.dat upx behavioral2/memory/3904-159-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022e71-161.dat upx behavioral2/memory/1648-165-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3520-167-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4364-168-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3904-169-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3520-170-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3904-171-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3904-172-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3904-173-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Users\\Admin\\AppData\\Roaming\\trys.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4840 set thread context of 4364 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 80 PID 1648 set thread context of 3520 1648 trys.exe 88 PID 1648 set thread context of 3904 1648 trys.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe Token: SeDebugPrivilege 3520 trys.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 4364 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 1648 trys.exe 3520 trys.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4364 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 80 PID 4840 wrote to memory of 4364 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 80 PID 4840 wrote to memory of 4364 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 80 PID 4840 wrote to memory of 4364 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 80 PID 4840 wrote to memory of 4364 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 80 PID 4840 wrote to memory of 4364 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 80 PID 4840 wrote to memory of 4364 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 80 PID 4840 wrote to memory of 4364 4840 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 80 PID 4364 wrote to memory of 2224 4364 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 81 PID 4364 wrote to memory of 2224 4364 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 81 PID 4364 wrote to memory of 2224 4364 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 81 PID 2224 wrote to memory of 1064 2224 cmd.exe 85 PID 2224 wrote to memory of 1064 2224 cmd.exe 85 PID 2224 wrote to memory of 1064 2224 cmd.exe 85 PID 4364 wrote to memory of 1648 4364 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 87 PID 4364 wrote to memory of 1648 4364 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 87 PID 4364 wrote to memory of 1648 4364 d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe 87 PID 1648 wrote to memory of 3520 1648 trys.exe 88 PID 1648 wrote to memory of 3520 1648 trys.exe 88 PID 1648 wrote to memory of 3520 1648 trys.exe 88 PID 1648 wrote to memory of 3520 1648 trys.exe 88 PID 1648 wrote to memory of 3520 1648 trys.exe 88 PID 1648 wrote to memory of 3520 1648 trys.exe 88 PID 1648 wrote to memory of 3520 1648 trys.exe 88 PID 1648 wrote to memory of 3520 1648 trys.exe 88 PID 1648 wrote to memory of 3904 1648 trys.exe 89 PID 1648 wrote to memory of 3904 1648 trys.exe 89 PID 1648 wrote to memory of 3904 1648 trys.exe 89 PID 1648 wrote to memory of 3904 1648 trys.exe 89 PID 1648 wrote to memory of 3904 1648 trys.exe 89 PID 1648 wrote to memory of 3904 1648 trys.exe 89 PID 1648 wrote to memory of 3904 1648 trys.exe 89 PID 1648 wrote to memory of 3904 1648 trys.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe"C:\Users\Admin\AppData\Local\Temp\d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe"C:\Users\Admin\AppData\Local\Temp\d5791922c2a60630d9f777098fbee436ea7fe2a67c3807ad5a4c071ce1b35558.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XDVUQ.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f4⤵
- Adds Run key to start application
PID:1064
-
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3520
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"4⤵
- Executes dropped EXE
PID:3904
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD56dbb2090ff90500da05a027765cde190
SHA1425b833d9d1df8d6df6e5a59f738058808271949
SHA25671ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881
SHA5127e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3
-
Filesize
104KB
MD5d4799b9ce16508f141187b717ede578c
SHA1553e294ff8dfa98d0207b545faa375a0f2cdf46f
SHA256a515e465aadda02ad9a76ab4d46365d67646bee979ce6605bb13975ceda3e84b
SHA512e26535adc1aef19df1821f89773eb2960041cf0791107edefebeb92c04835004276635f9b8ba71ef2b1d63fe7abb048e6d1abf047da90f9a67369becb7aa1670
-
Filesize
104KB
MD5d4799b9ce16508f141187b717ede578c
SHA1553e294ff8dfa98d0207b545faa375a0f2cdf46f
SHA256a515e465aadda02ad9a76ab4d46365d67646bee979ce6605bb13975ceda3e84b
SHA512e26535adc1aef19df1821f89773eb2960041cf0791107edefebeb92c04835004276635f9b8ba71ef2b1d63fe7abb048e6d1abf047da90f9a67369becb7aa1670
-
Filesize
104KB
MD5d4799b9ce16508f141187b717ede578c
SHA1553e294ff8dfa98d0207b545faa375a0f2cdf46f
SHA256a515e465aadda02ad9a76ab4d46365d67646bee979ce6605bb13975ceda3e84b
SHA512e26535adc1aef19df1821f89773eb2960041cf0791107edefebeb92c04835004276635f9b8ba71ef2b1d63fe7abb048e6d1abf047da90f9a67369becb7aa1670
-
Filesize
104KB
MD5d4799b9ce16508f141187b717ede578c
SHA1553e294ff8dfa98d0207b545faa375a0f2cdf46f
SHA256a515e465aadda02ad9a76ab4d46365d67646bee979ce6605bb13975ceda3e84b
SHA512e26535adc1aef19df1821f89773eb2960041cf0791107edefebeb92c04835004276635f9b8ba71ef2b1d63fe7abb048e6d1abf047da90f9a67369becb7aa1670