Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
192s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
04/12/2022, 05:36
General
-
Target
b774466cbf5e7682dc7aed6dc00b072676964eb3bf5288078763f249258a6ac7.exe
-
Size
92KB
-
MD5
b72b1f0f7528b4a7055ebc1ff1fc4af9
-
SHA1
58e0b4749b2b08811677b5da729372b8baceba9a
-
SHA256
b774466cbf5e7682dc7aed6dc00b072676964eb3bf5288078763f249258a6ac7
-
SHA512
994a31bdceebee992a8062721d8d86c9c3572063398367627da3ab864b3d216ca77295ef5c33450a5931211141c02dff030b4ca4bb9248cd22db1203f5e641de
-
SSDEEP
1536:5xk7LJVGdm9RUAAUCTBkk46Nj3R28Fu2gg1ODzQmmsEZFTceN:Q74m9ULD28QNg1OnQ1sMueN
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b774466cbf5e7682dc7aed6dc00b072676964eb3bf5288078763f249258a6ac7.exe"C:\Users\Admin\AppData\Local\Temp\b774466cbf5e7682dc7aed6dc00b072676964eb3bf5288078763f249258a6ac7.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Ouycqd Uqaknxna\Explorer.exe.2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Ouycqd Uqaknxna\explorer.exeexplorer.exe3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260B
MD5bdb6d24c37cf01692c3ea5591446015d
SHA1fca90c08bb5e019f494ecd9bfabdc36b5a43bba3
SHA2563bec0b01c2ac14ca00841fad20586914b79a0829e9774b1fcded2ee3cf268c13
SHA5122e3c9b56dab0bcb7e7f831afb36198401d0320987248e2d90237a8882c7835a371d81c1bbb3bb0eba6219256ea251ba0c36a05241f86f42e7aa76b557e9c2651
-
Filesize
8.6MB
MD550d7a3a7f0a867122b4149d0f7bccd87
SHA1eb94797660abce8d9220d65309c0eac34f6c8996
SHA256d810bb7149a112cac4fdbdbbf3b33044a74783280c1cc600b494e5ee3d9d2254
SHA512a9dc44d8bb1b7cf2bb4cfe7e4e98dfa7c7e432f94157a879e4bc7a185160197f20fb50f98ae60b5c899e65383565adc17c55b06dc876ab2789af4dceedb04163
-
Filesize
8.6MB
MD550d7a3a7f0a867122b4149d0f7bccd87
SHA1eb94797660abce8d9220d65309c0eac34f6c8996
SHA256d810bb7149a112cac4fdbdbbf3b33044a74783280c1cc600b494e5ee3d9d2254
SHA512a9dc44d8bb1b7cf2bb4cfe7e4e98dfa7c7e432f94157a879e4bc7a185160197f20fb50f98ae60b5c899e65383565adc17c55b06dc876ab2789af4dceedb04163
-
Filesize
8.6MB
MD550d7a3a7f0a867122b4149d0f7bccd87
SHA1eb94797660abce8d9220d65309c0eac34f6c8996
SHA256d810bb7149a112cac4fdbdbbf3b33044a74783280c1cc600b494e5ee3d9d2254
SHA512a9dc44d8bb1b7cf2bb4cfe7e4e98dfa7c7e432f94157a879e4bc7a185160197f20fb50f98ae60b5c899e65383565adc17c55b06dc876ab2789af4dceedb04163