Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe
-
Size
150KB
-
MD5
dd60171a9b6dc182bded63a64e3e3f29
-
SHA1
a6f5a7f1c925f5b29b0eaaba479292ba3d3f7d6d
-
SHA256
892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b
-
SHA512
d4a78a26721a5077409518650baf1841ab8f9459ef11d16b68ba342c08235eb516fff8f7fde8f28376ab37055add68a39b86b2fb5b72f5ae354e425a745bc40e
-
SSDEEP
3072:0lctl8STlrLKnRVWh0q8ntMviU9tv+SRtcFcoeYkmkC1:0UlJTJLKXq8ntMviU9tmSRqiAkmJ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 5040 FBF9.tmp 2400 inl39BF.tmp -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation inl39BF.tmp -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{5518FC90-76A3-47FE-9440-7FF44A419D13} msiexec.exe File opened for modification C:\Windows\Installer\MSI69D6.tmp msiexec.exe File created C:\Windows\Installer\e575576.msi msiexec.exe File created C:\Windows\Installer\e575573.msi msiexec.exe File opened for modification C:\Windows\Installer\e575573.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log expand.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log expand.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2964 5040 WerFault.exe 78 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 2468 msiexec.exe 2468 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2112 msiexec.exe Token: SeIncreaseQuotaPrivilege 2112 msiexec.exe Token: SeSecurityPrivilege 2468 msiexec.exe Token: SeCreateTokenPrivilege 2112 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2112 msiexec.exe Token: SeLockMemoryPrivilege 2112 msiexec.exe Token: SeIncreaseQuotaPrivilege 2112 msiexec.exe Token: SeMachineAccountPrivilege 2112 msiexec.exe Token: SeTcbPrivilege 2112 msiexec.exe Token: SeSecurityPrivilege 2112 msiexec.exe Token: SeTakeOwnershipPrivilege 2112 msiexec.exe Token: SeLoadDriverPrivilege 2112 msiexec.exe Token: SeSystemProfilePrivilege 2112 msiexec.exe Token: SeSystemtimePrivilege 2112 msiexec.exe Token: SeProfSingleProcessPrivilege 2112 msiexec.exe Token: SeIncBasePriorityPrivilege 2112 msiexec.exe Token: SeCreatePagefilePrivilege 2112 msiexec.exe Token: SeCreatePermanentPrivilege 2112 msiexec.exe Token: SeBackupPrivilege 2112 msiexec.exe Token: SeRestorePrivilege 2112 msiexec.exe Token: SeShutdownPrivilege 2112 msiexec.exe Token: SeDebugPrivilege 2112 msiexec.exe Token: SeAuditPrivilege 2112 msiexec.exe Token: SeSystemEnvironmentPrivilege 2112 msiexec.exe Token: SeChangeNotifyPrivilege 2112 msiexec.exe Token: SeRemoteShutdownPrivilege 2112 msiexec.exe Token: SeUndockPrivilege 2112 msiexec.exe Token: SeSyncAgentPrivilege 2112 msiexec.exe Token: SeEnableDelegationPrivilege 2112 msiexec.exe Token: SeManageVolumePrivilege 2112 msiexec.exe Token: SeImpersonatePrivilege 2112 msiexec.exe Token: SeCreateGlobalPrivilege 2112 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeIncBasePriorityPrivilege 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 488 wrote to memory of 5040 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 78 PID 488 wrote to memory of 5040 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 78 PID 488 wrote to memory of 5040 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 78 PID 488 wrote to memory of 2112 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 82 PID 488 wrote to memory of 2112 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 82 PID 488 wrote to memory of 2112 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 82 PID 488 wrote to memory of 3840 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 84 PID 488 wrote to memory of 3840 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 84 PID 488 wrote to memory of 3840 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 84 PID 488 wrote to memory of 220 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 85 PID 488 wrote to memory of 220 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 85 PID 488 wrote to memory of 220 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 85 PID 488 wrote to memory of 1392 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 88 PID 488 wrote to memory of 1392 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 88 PID 488 wrote to memory of 1392 488 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 88 PID 220 wrote to memory of 4820 220 cmd.exe 90 PID 220 wrote to memory of 4820 220 cmd.exe 90 PID 220 wrote to memory of 4820 220 cmd.exe 90 PID 3840 wrote to memory of 2400 3840 cmd.exe 93 PID 3840 wrote to memory of 2400 3840 cmd.exe 93 PID 3840 wrote to memory of 2400 3840 cmd.exe 93 PID 2468 wrote to memory of 4524 2468 msiexec.exe 97 PID 2468 wrote to memory of 4524 2468 msiexec.exe 97 PID 2468 wrote to memory of 4524 2468 msiexec.exe 97 PID 2400 wrote to memory of 2952 2400 inl39BF.tmp 102 PID 2400 wrote to memory of 2952 2400 inl39BF.tmp 102 PID 2400 wrote to memory of 2952 2400 inl39BF.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe"C:\Users\Admin\AppData\Local\Temp\892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Roaming\FBF9.tmpC:\Users\Admin\AppData\Roaming\FBF9.tmp2⤵
- Executes dropped EXE
PID:5040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 2283⤵
- Program crash
PID:2964
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INS227~1.INI /quiet2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\inl39BF.tmpC:\Users\Admin\AppData\Local\Temp\inl39BF.tmp cdf1912.tmp3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl39BF.tmp > nul4⤵PID:2952
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"3⤵
- Drops file in Windows directory
PID:4820
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\892D35~1.EXE > nul2⤵PID:1392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5040 -ip 50401⤵PID:5028
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7358D39CBF96E0ECBC5F94A4C1E604B22⤵PID:4524
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD563e19b74dd81985464c5f3804ae1b0ac
SHA1ee35368a1f44775820d1698a6db7e7c8ebf0171b
SHA2569c933da0fe6e0eb5344dae3fa999b1b2652188839ff5ee4db0b82020fa9f6cd0
SHA512f51b54cb1d98270827c8a9da858756d1fc819b2905129f9ae13b69aff2f5088a41275d5ed946471dd6cafb7792e369f6afebd178df4751aececa87aa3666fba5
-
Filesize
768B
MD5d20d9eda31a2d0300e4589df7f352370
SHA179b46d2dbb489914cfedafdbc90e62951471b48e
SHA256d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8
SHA512d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e
-
Filesize
57.2MB
MD50452f49489bdfcbfeddd7d963395b974
SHA12e90d39aa4db4d7c6ee55ff1bec6e3f3eb53d118
SHA256e20484b1a1f72d18c9ac3397d4ae7e1b49a65e2d3d14170b973746402c210181
SHA512bae43307dd3035f68879b6887e7ca2eeaa44efce9c13752d914a487f72df41c6732be1fe3b988884ad28b56bde529fda482c5c82b4d8e659184a65d43e0caf06
-
Filesize
57.2MB
MD50452f49489bdfcbfeddd7d963395b974
SHA12e90d39aa4db4d7c6ee55ff1bec6e3f3eb53d118
SHA256e20484b1a1f72d18c9ac3397d4ae7e1b49a65e2d3d14170b973746402c210181
SHA512bae43307dd3035f68879b6887e7ca2eeaa44efce9c13752d914a487f72df41c6732be1fe3b988884ad28b56bde529fda482c5c82b4d8e659184a65d43e0caf06
-
Filesize
57B
MD55f9b7d6393922f781fe39273f53b0a4d
SHA1f78bcc9713ed2669d9edeb04a6cba66b8ab843b5
SHA2563c186149cc34a7a6c9cf940fcbced3eafcf9e86adb020334dc1e16dc3aeb03e7
SHA512cf281f7757acc1e3ce19a03dc094ae78de79a300b0e3b01b6862ba7a5f404e3a712447dde50964c4b6b824e0b6b83b587d613f17262e6558e7f8a8b2a1f754d8
-
Filesize
98B
MD58663de6fce9208b795dc913d1a6a3f5b
SHA1882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA2562909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA5129381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688
-
Filesize
345.0MB
MD577b26596ee4eae4e878b80482e91370a
SHA11876eefa05b838824615a2fbb2babf380e827b87
SHA2562a67ae8df269e655bb17be187620d510130d6f771e1ca1cf32edd84ed780eb49
SHA51257ca19e2cf8a7ccc6a870048e78d4d5e736f11ecf285dac0e3e62e7f7e6135f2a8e943db78f3fe7f5b51f5180f4cea8e76b3a1c112d2aa9218feae53a537dcf2
-
Filesize
345.0MB
MD577b26596ee4eae4e878b80482e91370a
SHA11876eefa05b838824615a2fbb2babf380e827b87
SHA2562a67ae8df269e655bb17be187620d510130d6f771e1ca1cf32edd84ed780eb49
SHA51257ca19e2cf8a7ccc6a870048e78d4d5e736f11ecf285dac0e3e62e7f7e6135f2a8e943db78f3fe7f5b51f5180f4cea8e76b3a1c112d2aa9218feae53a537dcf2
-
Filesize
425B
MD5da68bc3b7c3525670a04366bc55629f5
SHA115fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA25673f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA5126fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0