Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 07:41
Static task
static1
Behavioral task
behavioral1
Sample
b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe
Resource
win10v2004-20220901-en
General
-
Target
b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe
-
Size
64KB
-
MD5
bbb2750f399b2cbc8f2de9649c58772b
-
SHA1
2269d16ab10fdf3187014c60292338c68b26f76c
-
SHA256
b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae
-
SHA512
96e40e540510bb8334d2065b2c889240502677b46f750b57234f4efd3d34bf13639c8c3eb0452bcdab73b5ac9bbbede1f86d8abffac8f05a35f527a5f1fad2ae
-
SSDEEP
1536:xET64WKch3dQzOwtwSI3yHBUJu5OXIvzpjIp/n:xq64Wx3dmqSSyHBknGzpjA/n
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4980 wrote to memory of 3252 4980 b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe 81 PID 4980 wrote to memory of 3252 4980 b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe 81 PID 4980 wrote to memory of 3252 4980 b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe"C:\Users\Admin\AppData\Local\Temp\b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Phz..bat" > nul 2> nul2⤵PID:3252
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274B
MD5d9305a1b8b55c52f80f06b23f0cf5cb9
SHA14a33834bf0fc295a6b373d17259afc125b9625c8
SHA2563d90f259bcc7f14722f35c40d9e2171f207fa8b5df1ea682c466369bc2332e60
SHA5120f675f85c08988268c45f496871db502f0a48f0690a6c9f660d62e022817f5e302e6adb6c3f76a1ba1849c745e10ef91487654bb8dbf37dba29dfdb42f3045ce