Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 19:36
Static task
static1
Behavioral task
behavioral1
Sample
a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe
Resource
win10v2004-20220812-en
General
-
Target
a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe
-
Size
92KB
-
MD5
6a915e71e0ccfdfbf873d4c344b91c7d
-
SHA1
5fb0e3c222fc3b75406a67a44ce75f8d2af30f20
-
SHA256
a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621
-
SHA512
0ac0c5ebacc310d4edea3859c69abd92bc34782d298b240c64065ff8feb1fb93729ff902d705e9651e5f670dd0ae42bf54d59e775f6437da1a745b298c9134f7
-
SSDEEP
1536:/rT5WG67FWBMk/r2mvWh7XjNd3s3WX2o2PYFzwJOpWB8aPzeZIZAKkxTE4n0xC7/://YL7f4r2RheSFrWB8aLe4A/xTEe0Mz
Malware Config
Signatures
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3180 set thread context of 3732 3180 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 79 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\0E7j2JL.com a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe File opened for modification C:\Windows\Fonts\0E7j2JL.com a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3732 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 3732 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3180 wrote to memory of 3732 3180 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 79 PID 3180 wrote to memory of 3732 3180 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 79 PID 3180 wrote to memory of 3732 3180 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 79 PID 3180 wrote to memory of 3732 3180 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 79 PID 3180 wrote to memory of 3732 3180 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 79 PID 3180 wrote to memory of 3732 3180 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 79 PID 3180 wrote to memory of 3732 3180 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 79 PID 3180 wrote to memory of 3732 3180 a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe"C:\Users\Admin\AppData\Local\Temp\a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe"C:\Users\Admin\AppData\Local\Temp\a294258e8b2e1fd36217a8fafd15c41c3954eec26808407c03cf40df1df9d621.exe"2⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2212