Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    273s
  • max time network
    367s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 02:41

General

  • Target

    e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe

  • Size

    54KB

  • MD5

    2a3fb18c680d1db507969f93ad76b726

  • SHA1

    9a60bb7131f93e94274ffbfb722f4b53b906d6b1

  • SHA256

    e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803

  • SHA512

    d59c90e640e45e326096581b935a018f2f007607ac1c27471c723c39cbf7c314e11442c7cba34bf3635dcb6c8a8d8d6a76e5b5a68c5670e5104b1960f38bf344

  • SSDEEP

    768:6rpGUKbGPJfS/A+0jmlZ8veI+2qYg7ZffFLCNnbcuyD7U7R:6Hq/ADjmlZ8GITMdL2nouy87R

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
    "C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\VUV.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      PID:4832
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c taskkill /im coiome.exe /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im coiome.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4552
    • C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe
      "C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4588
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe"
      2⤵
        PID:1352

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe

      Filesize

      12.1MB

      MD5

      b33666d4d5854a01a5363c4ce51a4b4a

      SHA1

      9b7ea5dd27d76fe4dc054c135f6d2a5a0387f060

      SHA256

      892e2036c3ed72269cc43044f75c2597fd278e9ae3985220f4921e0dbd6355f7

      SHA512

      a9c96b7d87fbd885c0b70845e94fb1f95b52dd00bd6afda317d3308a900038017d14008de96c47423d016c69ef20c30e0cd577d6fc670030c6d1af321699ebc5

    • C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe

      Filesize

      12.1MB

      MD5

      b33666d4d5854a01a5363c4ce51a4b4a

      SHA1

      9b7ea5dd27d76fe4dc054c135f6d2a5a0387f060

      SHA256

      892e2036c3ed72269cc43044f75c2597fd278e9ae3985220f4921e0dbd6355f7

      SHA512

      a9c96b7d87fbd885c0b70845e94fb1f95b52dd00bd6afda317d3308a900038017d14008de96c47423d016c69ef20c30e0cd577d6fc670030c6d1af321699ebc5

    • C:\Program Files (x86)\VUV.hta

      Filesize

      780B

      MD5

      cfae0efb683986503bb789616bad8b55

      SHA1

      9325f503e9c4d97a7d06d81859f73d245a974753

      SHA256

      8f1076023a3e05a05e9938b08398e885a516f7442a19cd0de7fd3a87f6c0ccd8

      SHA512

      e338c41006f670cc98554f1c3a262cc7e4d9dd680bd9d77cc2b5a048a7f3b630f59df6a02fe6542df71647ce3eb7541f86bc3266fad396a9859620a7d26a942c

    • memory/3244-132-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/3244-142-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/4588-141-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB