Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    185s
  • max time network
    213s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 19:09

General

  • Target

    0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe

  • Size

    763KB

  • MD5

    12740aef11f73a73631febc24be8ba37

  • SHA1

    e0a47fba751d5d617f651d38995efbc0d70ac6f7

  • SHA256

    0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a

  • SHA512

    124b89a54e69732e2f049f51a7be06daeda8e9c81139fbc7362b33b4c08cb80e0f1092b124b46967c3a158e8a5c78524996aab66313aff856427f62a99ed9b6a

  • SSDEEP

    12288:wTuo6lqeI2+uJvIgqckmpYYK/G2K/1lFoSE0vr1q6j+YpXHu1QhRDbSg1J:sjVeI2+ZsvcTUbFdHqgr3u1QhRDbH

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe
    "C:\Users\Admin\AppData\Local\Temp\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exe
      C:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exe "e0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe" "0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe" "4f1861067e0b446c969491136a398468" dec
      2⤵
      • Executes dropped EXE
      PID:4944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exe

    Filesize

    117KB

    MD5

    04564d86553fcff6631250752e9b9b9b

    SHA1

    3093e6848fbfdb71f948fdd50f588e46bc760f31

    SHA256

    2f1ef4466a10d6203902ce54e2d9df9f40c35789eaa7f5ae15ce277fbba5c82b

    SHA512

    e96abb892610d6289f818ddf2ec76515a817ce4eebd977a6564850cb6b0092405adc85b4fcae299b03fd5897a5de65b224cd891ff07c24395f1c681bcc650887

  • C:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exe

    Filesize

    117KB

    MD5

    04564d86553fcff6631250752e9b9b9b

    SHA1

    3093e6848fbfdb71f948fdd50f588e46bc760f31

    SHA256

    2f1ef4466a10d6203902ce54e2d9df9f40c35789eaa7f5ae15ce277fbba5c82b

    SHA512

    e96abb892610d6289f818ddf2ec76515a817ce4eebd977a6564850cb6b0092405adc85b4fcae299b03fd5897a5de65b224cd891ff07c24395f1c681bcc650887

  • C:\Users\Admin\AppData\Local\Temp\DM\0083a3f10b30be2b8b8844694de8118910ace0ec91c60f63b83c0ff53470cc5a.exe\gnspfwenWE\launch.exe.config

    Filesize

    340B

    MD5

    91629f6b28cbe2b52bb86cb5af3bdbca

    SHA1

    35fb57ac58c9eb0668f5832a588d9f81e040568b

    SHA256

    589c122996fadc118731c6f983c5d3b498c4b4b59700ea548f4cfb79e4eaaeeb

    SHA512

    f08382296696173784841a163c73c19e7bd674a08a053c0434d55696f45039721925e5d829e4bbbf71b07385d1b88c5ea241b8247eb0d81bf381205977bd14c5

  • C:\Users\Admin\AppData\Local\Temp\nsn74A5.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • C:\Users\Admin\AppData\Local\Temp\nsn74A5.tmp\pwgen.dll

    Filesize

    16KB

    MD5

    a555472395178ac8c733d90928e05017

    SHA1

    f44b192d66473f01a6540aaec4b6c9ac4c611d35

    SHA256

    82ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e

    SHA512

    e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a

  • memory/4944-138-0x0000000072FD0000-0x0000000073581000-memory.dmp

    Filesize

    5.7MB

  • memory/4944-139-0x0000000072FD0000-0x0000000073581000-memory.dmp

    Filesize

    5.7MB