Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 19:36

General

  • Target

    a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe

  • Size

    92KB

  • MD5

    6a915e71e0ccfdfbf873d4c344b91c7d

  • SHA1

    5fb0e3c222fc3b75406a67a44ce75f8d2af30f20

  • SHA256

    a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621

  • SHA512

    0ac0c5ebacc310d4edea3859c69abd92bc34782d298b240c64065ff8feb1fb93729ff902d705e9651e5f670dd0ae42bf54d59e775f6437da1a745b298c9134f7

  • SSDEEP

    1536:/rT5WG67FWBMk/r2mvWh7XjNd3s3WX2o2PYFzwJOpWB8aPzeZIZAKkxTE4n0xC7/://YL7f4r2RheSFrWB8aLe4A/xTEe0Mz

Score
7/10

Malware Config

Signatures

  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe
    "C:\Users\Admin\AppData\Local\Temp\a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3180
    • C:\Users\Admin\AppData\Local\Temp\a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe
      "C:\Users\Admin\AppData\Local\Temp\a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe"
      2⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:3732
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2212

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3732-133-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/3732-135-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/3732-136-0x0000000010000000-0x000000001000A000-memory.dmp

      Filesize

      40KB

    • memory/3732-140-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB