Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
04/12/2022, 01:11
General
-
Target
b06e80c592478fcd240edfe7ff03a424237644ca0b3d9782f23a1e6dec0ed2b9.exe
-
Size
710KB
-
MD5
ed69f75d301d5a8a809bc3c74eb7f5e8
-
SHA1
e2d6c9bbdfe23b299a424bbcba43e0d9a491e751
-
SHA256
b06e80c592478fcd240edfe7ff03a424237644ca0b3d9782f23a1e6dec0ed2b9
-
SHA512
33a62537c650c7c28e427f018df63a3191fc5843af911cb7faeee3a43ca5cff70f61e2b70d93c0c2687ff0eebf3d02ab7f192c3bcdd5a60762b5803bcc8ff1dd
-
SSDEEP
12288:zqjmCWSjYYrLo4sCONwJ61p4SHqbn3OAelodAbqYAauT:Ojw8olC/WpbHqbn34QGuT
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b06e80c592478fcd240edfe7ff03a424237644ca0b3d9782f23a1e6dec0ed2b9.exe"C:\Users\Admin\AppData\Local\Temp\b06e80c592478fcd240edfe7ff03a424237644ca0b3d9782f23a1e6dec0ed2b9.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "EVKey - Vietnamese Keyboard" /F2⤵
-