Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 17:36
Static task
static1
Behavioral task
behavioral1
Sample
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe
Resource
win10v2004-20221111-en
General
-
Target
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe
-
Size
180KB
-
MD5
9ad02f7a000557841df40137de302ad7
-
SHA1
73a57c739a63126bf519690cbb6e5524d6cb1f47
-
SHA256
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
-
SHA512
510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b
-
SSDEEP
3072:1l4v+FlO+cPtrcfC3czXwlZqJwmHDquZfFrvQKvu5aLMN4yN6sZqJwmHDquZf+:1lkXztwYiwlZqJwmHDquZfFrvQKvu5aE
Malware Config
Extracted
tofsee
89.149.236.147
188.165.132.183
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1908 ulxn.exe 1364 ulxn.exe -
Deletes itself 1 IoCs
pid Process 1912 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\ulxn.exe\" /r" b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1708 set thread context of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1908 set thread context of 1364 1908 ulxn.exe 30 PID 1364 set thread context of 1128 1364 ulxn.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 1708 wrote to memory of 344 1708 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 28 PID 344 wrote to memory of 1908 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 29 PID 344 wrote to memory of 1908 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 29 PID 344 wrote to memory of 1908 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 29 PID 344 wrote to memory of 1908 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 29 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1908 wrote to memory of 1364 1908 ulxn.exe 30 PID 1364 wrote to memory of 1128 1364 ulxn.exe 31 PID 1364 wrote to memory of 1128 1364 ulxn.exe 31 PID 1364 wrote to memory of 1128 1364 ulxn.exe 31 PID 1364 wrote to memory of 1128 1364 ulxn.exe 31 PID 1364 wrote to memory of 1128 1364 ulxn.exe 31 PID 1364 wrote to memory of 1128 1364 ulxn.exe 31 PID 344 wrote to memory of 1912 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 32 PID 344 wrote to memory of 1912 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 32 PID 344 wrote to memory of 1912 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 32 PID 344 wrote to memory of 1912 344 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe"C:\Users\Admin\AppData\Local\Temp\b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe"C:\Users\Admin\AppData\Local\Temp\b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\ulxn.exe"C:\Users\Admin\ulxn.exe" /r3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\ulxn.exe"C:\Users\Admin\ulxn.exe" /r4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵PID:1128
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3620.bat" "3⤵
- Deletes itself
PID:1912
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD524b777478a14cf527d10f71ea8058cad
SHA152e2ef197753d4256c037e7fbbbf56cb48aa2d79
SHA256dc2a2fc30eb20ab79a3c5c5806445ca8bd786b4561e20d5db1af62c0f101fdb3
SHA512abd4a959985839c4be74a52c413a038bb2138fc18cbf967f84227f10e9dc8cd24ef2653829900fabed1840222d7d67486a74d4ece193f903475c23f6d47f0587
-
Filesize
180KB
MD59ad02f7a000557841df40137de302ad7
SHA173a57c739a63126bf519690cbb6e5524d6cb1f47
SHA256b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
SHA512510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b
-
Filesize
180KB
MD59ad02f7a000557841df40137de302ad7
SHA173a57c739a63126bf519690cbb6e5524d6cb1f47
SHA256b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
SHA512510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b
-
Filesize
180KB
MD59ad02f7a000557841df40137de302ad7
SHA173a57c739a63126bf519690cbb6e5524d6cb1f47
SHA256b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
SHA512510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b
-
Filesize
180KB
MD59ad02f7a000557841df40137de302ad7
SHA173a57c739a63126bf519690cbb6e5524d6cb1f47
SHA256b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
SHA512510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b
-
Filesize
180KB
MD59ad02f7a000557841df40137de302ad7
SHA173a57c739a63126bf519690cbb6e5524d6cb1f47
SHA256b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
SHA512510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b