Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe
Resource
win10v2004-20220812-en
General
-
Target
cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe
-
Size
42KB
-
MD5
c6b81c7fb7d688711923a3774432f42d
-
SHA1
a4df01899ea43820b1661c57175019dfd6e602a3
-
SHA256
cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
-
SHA512
9f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
SSDEEP
768:uBUaZmvRRaO52tjS+YC5tZvx0HRVzJ1gFqDhgpVmcLek/c3Lqyu9usvSKvQkv:uBc6GC5bpMMuCuCek/c3LqbEWvQkv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1208 hdnzcucu.exe 3304 hdnzcucu.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation hdnzcucu.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation hdnzcucu.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\hdnzcucu.exe cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe File opened for modification \??\c:\windows\SysWOW64\hdnzcucu.exe cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000001} cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 hdnzcucu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 hdnzcucu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4804 wrote to memory of 1656 4804 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 81 PID 4804 wrote to memory of 1656 4804 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 81 PID 4804 wrote to memory of 1656 4804 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 81 PID 4804 wrote to memory of 1208 4804 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 82 PID 4804 wrote to memory of 1208 4804 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 82 PID 4804 wrote to memory of 1208 4804 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 82 PID 1208 wrote to memory of 1196 1208 hdnzcucu.exe 83 PID 1208 wrote to memory of 1196 1208 hdnzcucu.exe 83 PID 1208 wrote to memory of 1196 1208 hdnzcucu.exe 83 PID 1208 wrote to memory of 3304 1208 hdnzcucu.exe 84 PID 1208 wrote to memory of 3304 1208 hdnzcucu.exe 84 PID 1208 wrote to memory of 3304 1208 hdnzcucu.exe 84 PID 3304 wrote to memory of 2544 3304 hdnzcucu.exe 85 PID 3304 wrote to memory of 2544 3304 hdnzcucu.exe 85 PID 3304 wrote to memory of 2544 3304 hdnzcucu.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe"C:\Users\Admin\AppData\Local\Temp\cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s2⤵PID:1656
-
-
C:\windows\SysWOW64\hdnzcucu.exe"C:\windows\system32\hdnzcucu.exe" -kill c:\users\admin\appdata\local\temp\cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe /install2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s3⤵PID:1196
-
-
C:\windows\SysWOW64\hdnzcucu.exe"C:\windows\system32\hdnzcucu.exe" -kill c:\windows\syswow64\hdnzcucu.exe /install /install3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s4⤵PID:2544
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1