Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 19:09
Static task
static1
Behavioral task
behavioral1
Sample
0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe
Resource
win10v2004-20221111-en
General
-
Target
0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe
-
Size
763KB
-
MD5
12740aef11f73a73631febc24be8ba37
-
SHA1
e0a47fba751d5d617f651d38995efbc0d70ac6f7
-
SHA256
0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a
-
SHA512
124b89a54e69732e2f049f51a7be06daeda8e9c81139fbc7362b33b4c08cb80e0f1092b124b46967c3a158e8a5c78524996aab66313aff856427f62a99ed9b6a
-
SSDEEP
12288:wTuo6lqeI2+uJvIgqckmpYYK/G2K/1lFoSE0vr1q6j+YpXHu1QhRDbSg1J:sjVeI2+ZsvcTUbFdHqgr3u1QhRDbH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4944 launch.exe -
Loads dropped DLL 2 IoCs
pid Process 2212 0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe 2212 0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2212 wrote to memory of 4944 2212 0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe 89 PID 2212 wrote to memory of 4944 2212 0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe 89 PID 2212 wrote to memory of 4944 2212 0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe"C:\Users\Admin\AppData\Local\Temp\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exeC:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exe "e0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe" "0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe" "4f1861067e0b446c969491136a398468" dec2⤵
- Executes dropped EXE
PID:4944
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exe
Filesize117KB
MD504564d86553fcff6631250752e9b9b9b
SHA13093e6848fbfdb71f948fdd50f588e46bc760f31
SHA2562f1ef4466a10d6203902ce54e2d9df9f40c35789eaa7f5ae15ce277fbba5c82b
SHA512e96abb892610d6289f818ddf2ec76515a817ce4eebd977a6564850cb6b0092405adc85b4fcae299b03fd5897a5de65b224cd891ff07c24395f1c681bcc650887
-
C:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exe
Filesize117KB
MD504564d86553fcff6631250752e9b9b9b
SHA13093e6848fbfdb71f948fdd50f588e46bc760f31
SHA2562f1ef4466a10d6203902ce54e2d9df9f40c35789eaa7f5ae15ce277fbba5c82b
SHA512e96abb892610d6289f818ddf2ec76515a817ce4eebd977a6564850cb6b0092405adc85b4fcae299b03fd5897a5de65b224cd891ff07c24395f1c681bcc650887
-
C:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exe.config
Filesize340B
MD591629f6b28cbe2b52bb86cb5af3bdbca
SHA135fb57ac58c9eb0668f5832a588d9f81e040568b
SHA256589c122996fadc118731c6f983c5d3b498c4b4b59700ea548f4cfb79e4eaaeeb
SHA512f08382296696173784841a163c73c19e7bd674a08a053c0434d55696f45039721925e5d829e4bbbf71b07385d1b88c5ea241b8247eb0d81bf381205977bd14c5
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
16KB
MD5a555472395178ac8c733d90928e05017
SHA1f44b192d66473f01a6540aaec4b6c9ac4c611d35
SHA25682ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e
SHA512e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a