Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
217s -
max time network
240s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16.exe
Resource
win10v2004-20221111-en
General
-
Target
9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16.exe
-
Size
1.2MB
-
MD5
11b084f40cde217ccfba12740e196b82
-
SHA1
e8c35d9f0b5cec779d1ca04171c440d4dcf0a89f
-
SHA256
9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16
-
SHA512
68849762ee2a64c5798c8858e304700ed619c647011a1c6a2ed0763abed652b2ae69b34a48f0ebab863bccc07fb29ce20d738d852a6e55cd65fa1bc1fb24443d
-
SSDEEP
24576:shufXBD6QmXyVTzrMu042Hkuk9z9tlgX00rl7NkJUlkFhUYmb2EnB05sBe:shufXBXmi1MTHUxtyeJUlknuhB0d
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2500 temp.exe 5108 Hacker.com.cn.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Hacker.com.cn.exe temp.exe File opened for modification C:\Windows\Hacker.com.cn.exe temp.exe File created C:\Windows\uninstal.bat temp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2500 temp.exe Token: SeDebugPrivilege 5108 Hacker.com.cn.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5108 Hacker.com.cn.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3692 wrote to memory of 2500 3692 9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16.exe 82 PID 3692 wrote to memory of 2500 3692 9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16.exe 82 PID 3692 wrote to memory of 2500 3692 9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16.exe 82 PID 2500 wrote to memory of 4892 2500 temp.exe 85 PID 2500 wrote to memory of 4892 2500 temp.exe 85 PID 2500 wrote to memory of 4892 2500 temp.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16.exe"C:\Users\Admin\AppData\Local\Temp\9cf97b9419d0d8c4748bc4725aabde4d52bd3dcad129c6b0d9d3c71119a1af16.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat3⤵PID:4892
-
-
-
C:\Windows\Hacker.com.cn.exeC:\Windows\Hacker.com.cn.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5108
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
799KB
MD5aa245e648f6a64e3081a7eb4ebbf0ef5
SHA1d57a72db02af376e354b42d5186cb77b24d8c5e1
SHA256affdf9cfa189fa9a0b24edaeaa45c5d8dc0445c0da12e3b8d361b50e5cd1d1c6
SHA5121649833f511349aba1dbbd15697f6f707cf7b3c37603b7284af6e47f9a1e27cca04469690ce47447d4e48780d3821a73049102e810495e664f811cf3b2dc8e0c
-
Filesize
799KB
MD5aa245e648f6a64e3081a7eb4ebbf0ef5
SHA1d57a72db02af376e354b42d5186cb77b24d8c5e1
SHA256affdf9cfa189fa9a0b24edaeaa45c5d8dc0445c0da12e3b8d361b50e5cd1d1c6
SHA5121649833f511349aba1dbbd15697f6f707cf7b3c37603b7284af6e47f9a1e27cca04469690ce47447d4e48780d3821a73049102e810495e664f811cf3b2dc8e0c
-
Filesize
799KB
MD5aa245e648f6a64e3081a7eb4ebbf0ef5
SHA1d57a72db02af376e354b42d5186cb77b24d8c5e1
SHA256affdf9cfa189fa9a0b24edaeaa45c5d8dc0445c0da12e3b8d361b50e5cd1d1c6
SHA5121649833f511349aba1dbbd15697f6f707cf7b3c37603b7284af6e47f9a1e27cca04469690ce47447d4e48780d3821a73049102e810495e664f811cf3b2dc8e0c
-
Filesize
799KB
MD5aa245e648f6a64e3081a7eb4ebbf0ef5
SHA1d57a72db02af376e354b42d5186cb77b24d8c5e1
SHA256affdf9cfa189fa9a0b24edaeaa45c5d8dc0445c0da12e3b8d361b50e5cd1d1c6
SHA5121649833f511349aba1dbbd15697f6f707cf7b3c37603b7284af6e47f9a1e27cca04469690ce47447d4e48780d3821a73049102e810495e664f811cf3b2dc8e0c
-
Filesize
134B
MD5d844dfb0f997e4d32cdb6dafa4d7717a
SHA1eaa7b33e52129f946e1aca0ce3cf45a7ce36b5ec
SHA2560f38f96239893411209b61471bb7c2412a8637ce0e5cbf9cc3c23e14ee44759a
SHA512fdeeeda586bf1d748ab962bd579ab3ef69a59ab9306bd3b29663dd496bba31e0a20b62e6076c08bfef44ad821e9dd69e88a29a56d427cbba532947cf91947be5