Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 07:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe
-
Size
1.2MB
-
MD5
442d1b0edbb01eef836e7b54609e25ce
-
SHA1
8f3f639cb60ba7dfc68dfbc33f3d51bd077f60e5
-
SHA256
afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9
-
SHA512
7eeebec73d52847dedab284feaf275442dddbf5c73a7eb28601099fcd603a2fbf7979728cf5e229ce6bebd15890946f0ffff8d9397c7d988f79528d7e48dce95
-
SSDEEP
24576:QRmJkcoQricOIQxiZY1ia4jyS5qBc+Y3M8BMHGZSd+Fspy:lJZoQrbTFZY1iaoF
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Microsoft Corporation hHaVIGPDAeSSXhUh = "C:\\Users\\Admin\\AppData\\Roaming\\hHaVIGPDAeSSXhUh.exe" afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3716 set thread context of 3552 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe:Zone.Identifier:$DATA afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe File created C:\Users\Admin\AppData\Roaming\hHaVIGPDAeSSXhUh.exe:Zone.Identifier:$DATA afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe 3552 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3552 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3552 RegAsm.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3716 wrote to memory of 3552 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 85 PID 3716 wrote to memory of 3552 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 85 PID 3716 wrote to memory of 3552 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 85 PID 3716 wrote to memory of 3552 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 85 PID 3716 wrote to memory of 3552 3716 afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe"C:\Users\Admin\AppData\Local\Temp\afd2802b606fc2a3c3f04c1aef7521283a6aee04740535efa0cb8d106a2422b9.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3552
-