Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    178s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 01:04

General

  • Target

    75fbbde016bc886ed22feeb18e443d15b76717857861c23d8f6ac39778c66146.exe

  • Size

    205KB

  • MD5

    019dd6b43e539bb7161ba0c9e43a43e0

  • SHA1

    e8b8a0cbdd33edcb915af4d881659fced66863b0

  • SHA256

    75fbbde016bc886ed22feeb18e443d15b76717857861c23d8f6ac39778c66146

  • SHA512

    6c7f411a92ea59635dcf95a3430cdfbfbe77634b7c5d58488eece1d18be8d3736cdea82e5f65eccfeb145a23c28ec7a94f7558a77e388d37e56cf6b448a99a16

  • SSDEEP

    3072:IVHgCc4xGvbwcU9KQ2BBAHmaPxiVoIb5EL:VCc4xGxWKQ2Bonxj

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75fbbde016bc886ed22feeb18e443d15b76717857861c23d8f6ac39778c66146.exe
    "C:\Users\Admin\AppData\Local\Temp\75fbbde016bc886ed22feeb18e443d15b76717857861c23d8f6ac39778c66146.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Program Files (x86)\7a592f33\jusched.exe
      "C:\Program Files (x86)\7a592f33\jusched.exe"
      2⤵
      • Executes dropped EXE
      PID:4768

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\7a592f33\7a592f33

    Filesize

    17B

    MD5

    134c1d489094d6d3399f65b0e9aebc1f

    SHA1

    612a57fbe6ed3ab9c15b39451171d813314a28d5

    SHA256

    54f9150d1268f7b4b83dd9fc3ec32274bf749715a5806ff3ca5262f5427d6781

    SHA512

    b09bf60e4850d05261d81a124a647dd111f42480224eae8a3bd2f64736c38119953703f868ad34194a7ae6dad6aabff4081ba73df262bbe9f5327867c56a48ed

  • C:\Program Files (x86)\7a592f33\jusched.exe

    Filesize

    205KB

    MD5

    c2b206433e3cac3bd01463b78285ab77

    SHA1

    22d86c411ee6639eb012a97a6db3b70f8c18c9bb

    SHA256

    9e8b2711f581bde66dc83a518c0e510a21640296ed2f1cb30f648f19b9b845d4

    SHA512

    a61017a803d3324d83207997687c34e9c24b15dfce5b793c3359eb4ebb0b8fa2651e4ae562652f8115635a89139b9d22dac7ef03f2d4fc4bac478a9f70d71302

  • C:\Program Files (x86)\7a592f33\jusched.exe

    Filesize

    205KB

    MD5

    c2b206433e3cac3bd01463b78285ab77

    SHA1

    22d86c411ee6639eb012a97a6db3b70f8c18c9bb

    SHA256

    9e8b2711f581bde66dc83a518c0e510a21640296ed2f1cb30f648f19b9b845d4

    SHA512

    a61017a803d3324d83207997687c34e9c24b15dfce5b793c3359eb4ebb0b8fa2651e4ae562652f8115635a89139b9d22dac7ef03f2d4fc4bac478a9f70d71302

  • memory/4304-132-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/4304-133-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/4304-136-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/4768-138-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB