Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 18:36
Static task
static1
Behavioral task
behavioral1
Sample
b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe
Resource
win10v2004-20221111-en
General
-
Target
b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe
-
Size
1.2MB
-
MD5
03bb57c0b709f25040a1b9251aadb7eb
-
SHA1
3927c036a94e084eb629c196492565cd4db53eba
-
SHA256
b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183
-
SHA512
6b7b3d3c41825a46e931f209afe126b35c982ddc840caeca7597c32736bf4fc4dacbe447f6982654b0e922ce3db63422d0d44d0eee728cdf92a17ec737d5c170
-
SSDEEP
3072:qXJCFRSt63wPwWYhVTjJ5cHymR7w0YmS8O:LdnWYD95z4w0Dt
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2408 winlogon.exe 1696 winlogon.exe 1716 winlogon.exe 4508 winlogon.exe -
resource yara_rule behavioral2/memory/4668-134-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4668-136-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4668-137-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4668-140-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4668-145-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1696-150-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1696-151-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1696-154-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1148 set thread context of 4668 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 84 PID 2408 set thread context of 1696 2408 winlogon.exe 88 PID 1696 set thread context of 1716 1696 winlogon.exe 92 PID 1696 set thread context of 4508 1696 winlogon.exe 104 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1752 4508 WerFault.exe 104 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4668 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 1696 winlogon.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1148 wrote to memory of 428 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 83 PID 1148 wrote to memory of 428 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 83 PID 1148 wrote to memory of 428 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 83 PID 1148 wrote to memory of 4668 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 84 PID 1148 wrote to memory of 4668 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 84 PID 1148 wrote to memory of 4668 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 84 PID 1148 wrote to memory of 4668 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 84 PID 1148 wrote to memory of 4668 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 84 PID 1148 wrote to memory of 4668 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 84 PID 1148 wrote to memory of 4668 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 84 PID 1148 wrote to memory of 4668 1148 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 84 PID 4668 wrote to memory of 2408 4668 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 87 PID 4668 wrote to memory of 2408 4668 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 87 PID 4668 wrote to memory of 2408 4668 b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe 87 PID 2408 wrote to memory of 2416 2408 winlogon.exe 89 PID 2408 wrote to memory of 2416 2408 winlogon.exe 89 PID 2408 wrote to memory of 2416 2408 winlogon.exe 89 PID 2408 wrote to memory of 1696 2408 winlogon.exe 88 PID 2408 wrote to memory of 1696 2408 winlogon.exe 88 PID 2408 wrote to memory of 1696 2408 winlogon.exe 88 PID 2408 wrote to memory of 1696 2408 winlogon.exe 88 PID 2408 wrote to memory of 1696 2408 winlogon.exe 88 PID 2408 wrote to memory of 1696 2408 winlogon.exe 88 PID 2408 wrote to memory of 1696 2408 winlogon.exe 88 PID 2408 wrote to memory of 1696 2408 winlogon.exe 88 PID 1696 wrote to memory of 1716 1696 winlogon.exe 92 PID 1696 wrote to memory of 1716 1696 winlogon.exe 92 PID 1696 wrote to memory of 1716 1696 winlogon.exe 92 PID 1696 wrote to memory of 1716 1696 winlogon.exe 92 PID 1696 wrote to memory of 1716 1696 winlogon.exe 92 PID 1696 wrote to memory of 1716 1696 winlogon.exe 92 PID 1696 wrote to memory of 1716 1696 winlogon.exe 92 PID 1696 wrote to memory of 1716 1696 winlogon.exe 92 PID 1696 wrote to memory of 4508 1696 winlogon.exe 104 PID 1696 wrote to memory of 4508 1696 winlogon.exe 104 PID 1696 wrote to memory of 4508 1696 winlogon.exe 104 PID 1696 wrote to memory of 4508 1696 winlogon.exe 104 PID 1696 wrote to memory of 4508 1696 winlogon.exe 104 PID 1696 wrote to memory of 4508 1696 winlogon.exe 104 PID 1696 wrote to memory of 4508 1696 winlogon.exe 104 PID 1696 wrote to memory of 4508 1696 winlogon.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe"C:\Users\Admin\AppData\Local\Temp\b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\\svchost.exe2⤵PID:428
-
-
C:\Users\Admin\AppData\Local\Temp\b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183.exe
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\E696D64614\winlogon.exe
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Executes dropped EXE
PID:1716
-
-
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Executes dropped EXE
PID:4508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 126⤵
- Program crash
PID:1752
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\\svchost.exe4⤵PID:2416
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1716 -ip 17161⤵PID:2104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4508 -ip 45081⤵PID:868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD503bb57c0b709f25040a1b9251aadb7eb
SHA13927c036a94e084eb629c196492565cd4db53eba
SHA256b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183
SHA5126b7b3d3c41825a46e931f209afe126b35c982ddc840caeca7597c32736bf4fc4dacbe447f6982654b0e922ce3db63422d0d44d0eee728cdf92a17ec737d5c170
-
Filesize
1.2MB
MD503bb57c0b709f25040a1b9251aadb7eb
SHA13927c036a94e084eb629c196492565cd4db53eba
SHA256b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183
SHA5126b7b3d3c41825a46e931f209afe126b35c982ddc840caeca7597c32736bf4fc4dacbe447f6982654b0e922ce3db63422d0d44d0eee728cdf92a17ec737d5c170
-
Filesize
1.2MB
MD503bb57c0b709f25040a1b9251aadb7eb
SHA13927c036a94e084eb629c196492565cd4db53eba
SHA256b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183
SHA5126b7b3d3c41825a46e931f209afe126b35c982ddc840caeca7597c32736bf4fc4dacbe447f6982654b0e922ce3db63422d0d44d0eee728cdf92a17ec737d5c170
-
Filesize
1.2MB
MD503bb57c0b709f25040a1b9251aadb7eb
SHA13927c036a94e084eb629c196492565cd4db53eba
SHA256b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183
SHA5126b7b3d3c41825a46e931f209afe126b35c982ddc840caeca7597c32736bf4fc4dacbe447f6982654b0e922ce3db63422d0d44d0eee728cdf92a17ec737d5c170
-
Filesize
1.2MB
MD503bb57c0b709f25040a1b9251aadb7eb
SHA13927c036a94e084eb629c196492565cd4db53eba
SHA256b218041ae37bb4f37715722d97a5d7b7b6fa7de3bcffb0b2ccbdeb5b93bbf183
SHA5126b7b3d3c41825a46e931f209afe126b35c982ddc840caeca7597c32736bf4fc4dacbe447f6982654b0e922ce3db63422d0d44d0eee728cdf92a17ec737d5c170