Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 18:30

General

  • Target

    be843daa5e4298cfc7ac629d7928ec3b43d61230be57aa99b5a7c63f30e4f8f0.exe

  • Size

    929KB

  • MD5

    dff3eacc5af287364c9f7c2d1db6d6eb

  • SHA1

    612abe186dd2cd2d039fc14b2719b9bb272b5f26

  • SHA256

    be843daa5e4298cfc7ac629d7928ec3b43d61230be57aa99b5a7c63f30e4f8f0

  • SHA512

    e924ed0c80ab595f054ac34d28aebf0ebf4a0ec90daa003a894830d5931824b67a842881fa25a39c8e8dc160a5c984af0afba7bb5e40200a4fb0708bcb7fa25e

  • SSDEEP

    24576:lslXB0Eo/M+teLfBoioRipU7RPHGxqfS7bWCg6+v7O9hQA4Er:OlVQAfBwioOESmCg6+jO9uv4

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be843daa5e4298cfc7ac629d7928ec3b43d61230be57aa99b5a7c63f30e4f8f0.exe
    "C:\Users\Admin\AppData\Local\Temp\be843daa5e4298cfc7ac629d7928ec3b43d61230be57aa99b5a7c63f30e4f8f0.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Program Files (x86)\AAV\aav.exe
      "C:\Program Files (x86)\AAV\aav.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:4968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 568
        3⤵
        • Program crash
        PID:3524
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 580
        3⤵
        • Program crash
        PID:220
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4968 -ip 4968
    1⤵
      PID:2060
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4968 -ip 4968
      1⤵
        PID:1780

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\AAV\aav.exe

        Filesize

        369KB

        MD5

        93604de2115a746daf98eeeb335aa19e

        SHA1

        97398c0d1d16eb98760f99fbd43a5d77c3dad565

        SHA256

        891f2dbaa65221166f791b7c3a06432ab69098512941b0deeeebe9851a942fe3

        SHA512

        5e0d6cfb9b8877c7feb2535c498ee6aa92c88906b586597b2fa0f6ce6e04e5721a9cd9ce802da211c45ce404ea15fece65292f979bd9dfc2d8712c20f708d722

      • C:\Program Files (x86)\AAV\aav.exe

        Filesize

        369KB

        MD5

        93604de2115a746daf98eeeb335aa19e

        SHA1

        97398c0d1d16eb98760f99fbd43a5d77c3dad565

        SHA256

        891f2dbaa65221166f791b7c3a06432ab69098512941b0deeeebe9851a942fe3

        SHA512

        5e0d6cfb9b8877c7feb2535c498ee6aa92c88906b586597b2fa0f6ce6e04e5721a9cd9ce802da211c45ce404ea15fece65292f979bd9dfc2d8712c20f708d722

      • memory/2180-132-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/2180-138-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/4968-136-0x0000000000400000-0x000000000049A000-memory.dmp

        Filesize

        616KB

      • memory/4968-137-0x0000000000AA0000-0x0000000000ACC000-memory.dmp

        Filesize

        176KB

      • memory/4968-139-0x0000000000400000-0x000000000049A000-memory.dmp

        Filesize

        616KB

      • memory/4968-140-0x0000000000AA0000-0x0000000000ACC000-memory.dmp

        Filesize

        176KB

      • memory/4968-141-0x0000000000400000-0x000000000049A000-memory.dmp

        Filesize

        616KB