Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 08:04

General

  • Target

    c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe

  • Size

    1.1MB

  • MD5

    48d381fa3049c4bf0abe985f9aa083d8

  • SHA1

    6cd53da4b7908aaed0d80b1fff8d85cb421b80da

  • SHA256

    c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49

  • SHA512

    915918d4ffd5afb92a12f84703d9598740dda5f1c30d1a7b086b46b097599319d9407f91f749d6e8aef76f4b047d97d1a67154eb89a7ae182a604fb55d60421c

  • SSDEEP

    24576:ICFQEjfquy7ZYY2BhQ/6Lx9g/9fiQmXLGihhUS8ip:mltdYRQ/4ghTmFiS5p

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe
    "C:\Users\Admin\AppData\Local\Temp\c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
        3⤵
          PID:2320
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Éí·ÝÕý.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Éí·ÝÕý.exe
        2⤵
        • Executes dropped EXE
        PID:3104
    • C:\Windows\RavMonD.exe
      C:\Windows\RavMonD.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        2⤵
          PID:5116

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe

        Filesize

        862KB

        MD5

        c2526d46e23a811c40b13b1b5bf6602a

        SHA1

        213fa42ca98b2038dd859a441e4459d332a7d029

        SHA256

        ae22f1cffbe662f1d51075d28054476064e161cd4e2988f6ece292ded4a7814c

        SHA512

        167dce70215c14cb5b8dcae4e1b69e0aa2fde70710ff419bbfb818e333264607fc9267e7d3ec0f3dad7e4fe3bee94bf43106533c480a8419b142d97ef42f0a3c

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe

        Filesize

        862KB

        MD5

        c2526d46e23a811c40b13b1b5bf6602a

        SHA1

        213fa42ca98b2038dd859a441e4459d332a7d029

        SHA256

        ae22f1cffbe662f1d51075d28054476064e161cd4e2988f6ece292ded4a7814c

        SHA512

        167dce70215c14cb5b8dcae4e1b69e0aa2fde70710ff419bbfb818e333264607fc9267e7d3ec0f3dad7e4fe3bee94bf43106533c480a8419b142d97ef42f0a3c

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Éí·ÝÕý.exe

        Filesize

        632KB

        MD5

        6ed60dcba278ff0c8fe9df3dff0fa1e6

        SHA1

        a95d8d7c64fccf888e43c8130e6c4c31ab5b1ff4

        SHA256

        06ec04732f460b01beed07c52a3f52e756e37e0362b7bd268174f4fc63aa0cca

        SHA512

        1838a4f0d30add9cee3fb47d9aa9dc772d5f41e40faaf7b84a4a31fe41d886d89936cd32946606ca6f554ea7baf4e27f25aca104a90fc06e50c8dd8dd54b4273

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Éí·ÝÕý.exe

        Filesize

        632KB

        MD5

        6ed60dcba278ff0c8fe9df3dff0fa1e6

        SHA1

        a95d8d7c64fccf888e43c8130e6c4c31ab5b1ff4

        SHA256

        06ec04732f460b01beed07c52a3f52e756e37e0362b7bd268174f4fc63aa0cca

        SHA512

        1838a4f0d30add9cee3fb47d9aa9dc772d5f41e40faaf7b84a4a31fe41d886d89936cd32946606ca6f554ea7baf4e27f25aca104a90fc06e50c8dd8dd54b4273

      • C:\Windows\AFRWSI.DAT

        Filesize

        11KB

        MD5

        c998d8a5ae2f5ae6eb941217752cfb50

        SHA1

        bd2ee5d947f1d727afd952b066c64ceefbcc3879

        SHA256

        f03c18b5d94d2e8bc2dcff111bea2279f78a1ec78261069fea635f75eafee1e6

        SHA512

        89737072de9114f687036d1b1aa0e338f7040ef6074de7c4a9e639995ddc6b73a965e968426752420d900a7141aed2f03ba05ca874b1dd025d28d4401aa0b4ed

      • C:\Windows\AFRWSI.DAT

        Filesize

        11KB

        MD5

        c998d8a5ae2f5ae6eb941217752cfb50

        SHA1

        bd2ee5d947f1d727afd952b066c64ceefbcc3879

        SHA256

        f03c18b5d94d2e8bc2dcff111bea2279f78a1ec78261069fea635f75eafee1e6

        SHA512

        89737072de9114f687036d1b1aa0e338f7040ef6074de7c4a9e639995ddc6b73a965e968426752420d900a7141aed2f03ba05ca874b1dd025d28d4401aa0b4ed

      • C:\Windows\AFRWSI.DAT

        Filesize

        11KB

        MD5

        c998d8a5ae2f5ae6eb941217752cfb50

        SHA1

        bd2ee5d947f1d727afd952b066c64ceefbcc3879

        SHA256

        f03c18b5d94d2e8bc2dcff111bea2279f78a1ec78261069fea635f75eafee1e6

        SHA512

        89737072de9114f687036d1b1aa0e338f7040ef6074de7c4a9e639995ddc6b73a965e968426752420d900a7141aed2f03ba05ca874b1dd025d28d4401aa0b4ed

      • C:\Windows\HKENUY.DAT

        Filesize

        51KB

        MD5

        d58f992c53515c9f1fb9394a46f4cb48

        SHA1

        1f9909d227b93be10328e0abc64052da984657ba

        SHA256

        50c6b8848b0a9cf6a6b579928dc6e5c75cf7564c19bb7b40d86ba9d360ebb040

        SHA512

        3a87c279fbbbaff2bfe791c523716ad092c41099b8914ba369565014502d408084259d4efe6896d785c024935b181ca34cf49e3b79f3f1a89ee1c9d775635d94

      • C:\Windows\HKENUY.DAT

        Filesize

        51KB

        MD5

        d58f992c53515c9f1fb9394a46f4cb48

        SHA1

        1f9909d227b93be10328e0abc64052da984657ba

        SHA256

        50c6b8848b0a9cf6a6b579928dc6e5c75cf7564c19bb7b40d86ba9d360ebb040

        SHA512

        3a87c279fbbbaff2bfe791c523716ad092c41099b8914ba369565014502d408084259d4efe6896d785c024935b181ca34cf49e3b79f3f1a89ee1c9d775635d94

      • C:\Windows\HKENUY.DAT

        Filesize

        51KB

        MD5

        d58f992c53515c9f1fb9394a46f4cb48

        SHA1

        1f9909d227b93be10328e0abc64052da984657ba

        SHA256

        50c6b8848b0a9cf6a6b579928dc6e5c75cf7564c19bb7b40d86ba9d360ebb040

        SHA512

        3a87c279fbbbaff2bfe791c523716ad092c41099b8914ba369565014502d408084259d4efe6896d785c024935b181ca34cf49e3b79f3f1a89ee1c9d775635d94

      • C:\Windows\RavMonD.exe

        Filesize

        862KB

        MD5

        c2526d46e23a811c40b13b1b5bf6602a

        SHA1

        213fa42ca98b2038dd859a441e4459d332a7d029

        SHA256

        ae22f1cffbe662f1d51075d28054476064e161cd4e2988f6ece292ded4a7814c

        SHA512

        167dce70215c14cb5b8dcae4e1b69e0aa2fde70710ff419bbfb818e333264607fc9267e7d3ec0f3dad7e4fe3bee94bf43106533c480a8419b142d97ef42f0a3c

      • C:\Windows\RavMonD.exe

        Filesize

        862KB

        MD5

        c2526d46e23a811c40b13b1b5bf6602a

        SHA1

        213fa42ca98b2038dd859a441e4459d332a7d029

        SHA256

        ae22f1cffbe662f1d51075d28054476064e161cd4e2988f6ece292ded4a7814c

        SHA512

        167dce70215c14cb5b8dcae4e1b69e0aa2fde70710ff419bbfb818e333264607fc9267e7d3ec0f3dad7e4fe3bee94bf43106533c480a8419b142d97ef42f0a3c

      • C:\Windows\WORYJN.DAT

        Filesize

        55KB

        MD5

        6853cba3ccc11699c2d840f41c10393f

        SHA1

        80a430dcc2cb34b05d433f0f63b8ef8a6a09bbe3

        SHA256

        0bcf3f4ff7862cd885003b8ecc4d424a2fd418fd64412ffe95a9c4221cc3de59

        SHA512

        a02fef8b7c721459fa6f081a1208bf8dd84d957663b4d711b9f6f1731deedf977e5a391ec7481797da7a594c3dd133e84865133855dcdbe6da2128887270114c

      • C:\Windows\WORYJN.DAT

        Filesize

        55KB

        MD5

        6853cba3ccc11699c2d840f41c10393f

        SHA1

        80a430dcc2cb34b05d433f0f63b8ef8a6a09bbe3

        SHA256

        0bcf3f4ff7862cd885003b8ecc4d424a2fd418fd64412ffe95a9c4221cc3de59

        SHA512

        a02fef8b7c721459fa6f081a1208bf8dd84d957663b4d711b9f6f1731deedf977e5a391ec7481797da7a594c3dd133e84865133855dcdbe6da2128887270114c

      • C:\Windows\WORYJN.DAT

        Filesize

        55KB

        MD5

        6853cba3ccc11699c2d840f41c10393f

        SHA1

        80a430dcc2cb34b05d433f0f63b8ef8a6a09bbe3

        SHA256

        0bcf3f4ff7862cd885003b8ecc4d424a2fd418fd64412ffe95a9c4221cc3de59

        SHA512

        a02fef8b7c721459fa6f081a1208bf8dd84d957663b4d711b9f6f1731deedf977e5a391ec7481797da7a594c3dd133e84865133855dcdbe6da2128887270114c

      • C:\Windows\uninstal.bat

        Filesize

        150B

        MD5

        67e4ea2c3e65d3236c8266b9c116f67f

        SHA1

        7e87f925ccd68b2b7c9af9f92e118db1990234f9

        SHA256

        2dff6c390d03870cec06d16fe0191475fb87ad2330b78d03c15e7ff0bed8f00c

        SHA512

        1a3cf0443e932b9b57f32531b3d61c917b9eec19a4ba73336011041e16a0022c5e62b2c768b34a0bdc08ffd75bbaa0338719577001496c9de8a5638420b0a229

      • memory/3104-158-0x0000000000400000-0x0000000000475000-memory.dmp

        Filesize

        468KB

      • memory/3104-159-0x0000000000400000-0x0000000000475000-memory.dmp

        Filesize

        468KB

      • memory/4616-150-0x00000000017E0000-0x00000000017F3000-memory.dmp

        Filesize

        76KB

      • memory/4616-152-0x0000000001030000-0x000000000103F000-memory.dmp

        Filesize

        60KB

      • memory/4616-146-0x00000000016C0000-0x00000000016D2000-memory.dmp

        Filesize

        72KB

      • memory/4896-137-0x0000000001000000-0x00000000011ED000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-151-0x0000000000680000-0x00000000006D4000-memory.dmp

        Filesize

        336KB

      • memory/4896-132-0x0000000001000000-0x00000000011ED000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-133-0x0000000000680000-0x00000000006D4000-memory.dmp

        Filesize

        336KB

      • memory/4896-160-0x0000000001000000-0x00000000011ED000-memory.dmp

        Filesize

        1.9MB