Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 19:08

General

  • Target

    d0a232eadd492f1791cb584a35bf8026fc78230a16c1dfa6392a398a04b2ba90.exe

  • Size

    140KB

  • MD5

    684edc12bd98f9c13185d35d06d91510

  • SHA1

    24ad0bebfb31a376dc896c7014426e9627629757

  • SHA256

    d0a232eadd492f1791cb584a35bf8026fc78230a16c1dfa6392a398a04b2ba90

  • SHA512

    3856d7c7d51c2e95c5a3dd5d483b3bc786b97ecc4bb47ee99441e38eb0c99d862cf988e10d7b6b15595bce402a061249d20eb228cd38cdfc74a30ea3e959deb8

  • SSDEEP

    1536:26L0EBRh7jdkhV1ScqgxeVS1TLzL06D4o2+a+JToPu7Z4wmg0LexUQ9HtWjRnP3f:26DSGUeVCLf0662JcPkSg0tO8KGT

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 29 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0a232eadd492f1791cb584a35bf8026fc78230a16c1dfa6392a398a04b2ba90.exe
    "C:\Users\Admin\AppData\Local\Temp\d0a232eadd492f1791cb584a35bf8026fc78230a16c1dfa6392a398a04b2ba90.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Users\Admin\AppData\Local\Temp\d0a232eadd492f1791cb584a35bf8026fc78230a16c1dfa6392a398a04b2ba90.exe
      71
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Users\Admin\leexov.exe
        "C:\Users\Admin\leexov.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5056
        • C:\Users\Admin\leexov.exe
          71
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Maps connected drives based on registry
          • Drops autorun.inf file
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:5000

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\leexov.exe

    Filesize

    140KB

    MD5

    684edc12bd98f9c13185d35d06d91510

    SHA1

    24ad0bebfb31a376dc896c7014426e9627629757

    SHA256

    d0a232eadd492f1791cb584a35bf8026fc78230a16c1dfa6392a398a04b2ba90

    SHA512

    3856d7c7d51c2e95c5a3dd5d483b3bc786b97ecc4bb47ee99441e38eb0c99d862cf988e10d7b6b15595bce402a061249d20eb228cd38cdfc74a30ea3e959deb8

  • C:\Users\Admin\leexov.exe

    Filesize

    140KB

    MD5

    684edc12bd98f9c13185d35d06d91510

    SHA1

    24ad0bebfb31a376dc896c7014426e9627629757

    SHA256

    d0a232eadd492f1791cb584a35bf8026fc78230a16c1dfa6392a398a04b2ba90

    SHA512

    3856d7c7d51c2e95c5a3dd5d483b3bc786b97ecc4bb47ee99441e38eb0c99d862cf988e10d7b6b15595bce402a061249d20eb228cd38cdfc74a30ea3e959deb8

  • C:\Users\Admin\leexov.exe

    Filesize

    140KB

    MD5

    684edc12bd98f9c13185d35d06d91510

    SHA1

    24ad0bebfb31a376dc896c7014426e9627629757

    SHA256

    d0a232eadd492f1791cb584a35bf8026fc78230a16c1dfa6392a398a04b2ba90

    SHA512

    3856d7c7d51c2e95c5a3dd5d483b3bc786b97ecc4bb47ee99441e38eb0c99d862cf988e10d7b6b15595bce402a061249d20eb228cd38cdfc74a30ea3e959deb8

  • memory/4528-135-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4528-137-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4528-140-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4528-154-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/5000-153-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/5000-155-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB