Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    190s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 18:41

General

  • Target

    4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe

  • Size

    795KB

  • MD5

    e3f27a021ba6b751a101de3bf46c220b

  • SHA1

    9acd075d597fa9f919a64a4e47ebfa9a584a8507

  • SHA256

    4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467

  • SHA512

    ecb54d55944de99e96893110a4af1e1d164ed3d0245ebde3caa2f0b891035659bcd5627a7873776cf5994cf81fa231044a1e55dc7daac512b38d2e62d321f17b

  • SSDEEP

    24576:BueAYT/hmflRBmqPeQ93D4AQqRRdfcj4wMn0DVooC+g:BuCTsdRBZbDxQqRRdfc3MncVoD+g

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe
    "C:\Users\Admin\AppData\Local\Temp\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
      C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe "e4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe" "4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe" "3b58bf0f691b4f20b2d34b2b6f203603" dec
      2⤵
      • Executes dropped EXE
      PID:2992
    • C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe
      C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe /path="C:\Users\Admin\AppData\Local\Temp\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1772

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe

    Filesize

    325KB

    MD5

    68c21b1d783650d0f2b55f351f441283

    SHA1

    008873cbe3713a1f50fa82e96da0fd742192e73b

    SHA256

    5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

    SHA512

    2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

  • C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe

    Filesize

    325KB

    MD5

    68c21b1d783650d0f2b55f351f441283

    SHA1

    008873cbe3713a1f50fa82e96da0fd742192e73b

    SHA256

    5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

    SHA512

    2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

  • C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe.config

    Filesize

    690B

    MD5

    bca0ea75b6940aa86960d7b9098a5998

    SHA1

    3d57f82158ac72c7eb2e72ba19a80485d8103130

    SHA256

    5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

    SHA512

    260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

  • C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\e4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe

    Filesize

    325KB

    MD5

    13ee1c03daec55875db9808cebbfff5d

    SHA1

    e182704191ee3277c20d73d5d47a3774d8c978a8

    SHA256

    134887182a71915571ba2b5d8a9767f7008bd2282c7a123eab9816ade8290d0d

    SHA512

    36c40cd26a4106c173851095234515c99d49882993f74c2249436bf21b1a7a922d6a2284e6b063f4857ec24678d12e22fc2b40e642e60ffb266a32fd577b22c2

  • C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

    Filesize

    21KB

    MD5

    ae93c3a8315679a5fb24db3fe04e750c

    SHA1

    31a5a7a50040fea708aef69df0429ecf3d6054bd

    SHA256

    3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

    SHA512

    01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

  • C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

    Filesize

    21KB

    MD5

    ae93c3a8315679a5fb24db3fe04e750c

    SHA1

    31a5a7a50040fea708aef69df0429ecf3d6054bd

    SHA256

    3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

    SHA512

    01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

  • C:\Users\Admin\AppData\Local\Temp\DM\4bbbccee49e20cffd08ed8adc2866d00e9b13452dfd7b247e8906b14f79aa467.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe.config

    Filesize

    359B

    MD5

    05a59e8e79546860cf1e351e32e69404

    SHA1

    aef4ad7bcbd79f99feb7100f05938721f12f7dce

    SHA256

    a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

    SHA512

    6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

  • memory/1772-144-0x00007FFD9A6F0000-0x00007FFD9B126000-memory.dmp

    Filesize

    10.2MB

  • memory/1772-145-0x000000000170A000-0x000000000170F000-memory.dmp

    Filesize

    20KB

  • memory/1772-146-0x000000000170A000-0x000000000170F000-memory.dmp

    Filesize

    20KB

  • memory/2992-136-0x00000000732D0000-0x0000000073881000-memory.dmp

    Filesize

    5.7MB

  • memory/2992-137-0x00000000732D0000-0x0000000073881000-memory.dmp

    Filesize

    5.7MB

  • memory/2992-139-0x00000000732D0000-0x0000000073881000-memory.dmp

    Filesize

    5.7MB