Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 08:04
Static task
static1
Behavioral task
behavioral1
Sample
c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe
Resource
win10v2004-20220812-en
General
-
Target
c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe
-
Size
1.1MB
-
MD5
48d381fa3049c4bf0abe985f9aa083d8
-
SHA1
6cd53da4b7908aaed0d80b1fff8d85cb421b80da
-
SHA256
c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49
-
SHA512
915918d4ffd5afb92a12f84703d9598740dda5f1c30d1a7b086b46b097599319d9407f91f749d6e8aef76f4b047d97d1a67154eb89a7ae182a604fb55d60421c
-
SSDEEP
24576:ICFQEjfquy7ZYY2BhQ/6Lx9g/9fiQmXLGihhUS8ip:mltdYRQ/4ghTmFiS5p
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1412 3.exe 4616 RavMonD.exe 3104 Éí·ÝÕý.exe -
resource yara_rule behavioral2/files/0x0006000000022f71-156.dat upx behavioral2/files/0x0006000000022f71-157.dat upx behavioral2/memory/3104-158-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3104-159-0x0000000000400000-0x0000000000475000-memory.dmp upx -
Loads dropped DLL 6 IoCs
pid Process 4616 RavMonD.exe 4616 RavMonD.exe 4616 RavMonD.exe 4616 RavMonD.exe 4616 RavMonD.exe 4616 RavMonD.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\AFRWSI.DAT 3.exe File created C:\Windows\RavMonD.exe 3.exe File opened for modification C:\Windows\RavMonD.exe 3.exe File created C:\Windows\uninstal.bat 3.exe File created C:\Windows\HKENUY.DAT 3.exe File created C:\Windows\WORYJN.DAT 3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1412 3.exe Token: SeDebugPrivilege 4616 RavMonD.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4616 RavMonD.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4616 RavMonD.exe 4616 RavMonD.exe 4616 RavMonD.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4896 wrote to memory of 1412 4896 c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe 80 PID 4896 wrote to memory of 1412 4896 c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe 80 PID 4896 wrote to memory of 1412 4896 c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe 80 PID 4616 wrote to memory of 5116 4616 RavMonD.exe 82 PID 4616 wrote to memory of 5116 4616 RavMonD.exe 82 PID 1412 wrote to memory of 2320 1412 3.exe 83 PID 1412 wrote to memory of 2320 1412 3.exe 83 PID 1412 wrote to memory of 2320 1412 3.exe 83 PID 4896 wrote to memory of 3104 4896 c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe 85 PID 4896 wrote to memory of 3104 4896 c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe 85 PID 4896 wrote to memory of 3104 4896 c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe"C:\Users\Admin\AppData\Local\Temp\c3c0a4ea183877f4270825459ddd2275225a0a37e59d697e27c31b9633adcc49.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat3⤵PID:2320
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Éí·ÝÕý.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Éí·ÝÕý.exe2⤵
- Executes dropped EXE
PID:3104
-
-
C:\Windows\RavMonD.exeC:\Windows\RavMonD.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:5116
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
862KB
MD5c2526d46e23a811c40b13b1b5bf6602a
SHA1213fa42ca98b2038dd859a441e4459d332a7d029
SHA256ae22f1cffbe662f1d51075d28054476064e161cd4e2988f6ece292ded4a7814c
SHA512167dce70215c14cb5b8dcae4e1b69e0aa2fde70710ff419bbfb818e333264607fc9267e7d3ec0f3dad7e4fe3bee94bf43106533c480a8419b142d97ef42f0a3c
-
Filesize
862KB
MD5c2526d46e23a811c40b13b1b5bf6602a
SHA1213fa42ca98b2038dd859a441e4459d332a7d029
SHA256ae22f1cffbe662f1d51075d28054476064e161cd4e2988f6ece292ded4a7814c
SHA512167dce70215c14cb5b8dcae4e1b69e0aa2fde70710ff419bbfb818e333264607fc9267e7d3ec0f3dad7e4fe3bee94bf43106533c480a8419b142d97ef42f0a3c
-
Filesize
632KB
MD56ed60dcba278ff0c8fe9df3dff0fa1e6
SHA1a95d8d7c64fccf888e43c8130e6c4c31ab5b1ff4
SHA25606ec04732f460b01beed07c52a3f52e756e37e0362b7bd268174f4fc63aa0cca
SHA5121838a4f0d30add9cee3fb47d9aa9dc772d5f41e40faaf7b84a4a31fe41d886d89936cd32946606ca6f554ea7baf4e27f25aca104a90fc06e50c8dd8dd54b4273
-
Filesize
632KB
MD56ed60dcba278ff0c8fe9df3dff0fa1e6
SHA1a95d8d7c64fccf888e43c8130e6c4c31ab5b1ff4
SHA25606ec04732f460b01beed07c52a3f52e756e37e0362b7bd268174f4fc63aa0cca
SHA5121838a4f0d30add9cee3fb47d9aa9dc772d5f41e40faaf7b84a4a31fe41d886d89936cd32946606ca6f554ea7baf4e27f25aca104a90fc06e50c8dd8dd54b4273
-
Filesize
11KB
MD5c998d8a5ae2f5ae6eb941217752cfb50
SHA1bd2ee5d947f1d727afd952b066c64ceefbcc3879
SHA256f03c18b5d94d2e8bc2dcff111bea2279f78a1ec78261069fea635f75eafee1e6
SHA51289737072de9114f687036d1b1aa0e338f7040ef6074de7c4a9e639995ddc6b73a965e968426752420d900a7141aed2f03ba05ca874b1dd025d28d4401aa0b4ed
-
Filesize
11KB
MD5c998d8a5ae2f5ae6eb941217752cfb50
SHA1bd2ee5d947f1d727afd952b066c64ceefbcc3879
SHA256f03c18b5d94d2e8bc2dcff111bea2279f78a1ec78261069fea635f75eafee1e6
SHA51289737072de9114f687036d1b1aa0e338f7040ef6074de7c4a9e639995ddc6b73a965e968426752420d900a7141aed2f03ba05ca874b1dd025d28d4401aa0b4ed
-
Filesize
11KB
MD5c998d8a5ae2f5ae6eb941217752cfb50
SHA1bd2ee5d947f1d727afd952b066c64ceefbcc3879
SHA256f03c18b5d94d2e8bc2dcff111bea2279f78a1ec78261069fea635f75eafee1e6
SHA51289737072de9114f687036d1b1aa0e338f7040ef6074de7c4a9e639995ddc6b73a965e968426752420d900a7141aed2f03ba05ca874b1dd025d28d4401aa0b4ed
-
Filesize
51KB
MD5d58f992c53515c9f1fb9394a46f4cb48
SHA11f9909d227b93be10328e0abc64052da984657ba
SHA25650c6b8848b0a9cf6a6b579928dc6e5c75cf7564c19bb7b40d86ba9d360ebb040
SHA5123a87c279fbbbaff2bfe791c523716ad092c41099b8914ba369565014502d408084259d4efe6896d785c024935b181ca34cf49e3b79f3f1a89ee1c9d775635d94
-
Filesize
51KB
MD5d58f992c53515c9f1fb9394a46f4cb48
SHA11f9909d227b93be10328e0abc64052da984657ba
SHA25650c6b8848b0a9cf6a6b579928dc6e5c75cf7564c19bb7b40d86ba9d360ebb040
SHA5123a87c279fbbbaff2bfe791c523716ad092c41099b8914ba369565014502d408084259d4efe6896d785c024935b181ca34cf49e3b79f3f1a89ee1c9d775635d94
-
Filesize
51KB
MD5d58f992c53515c9f1fb9394a46f4cb48
SHA11f9909d227b93be10328e0abc64052da984657ba
SHA25650c6b8848b0a9cf6a6b579928dc6e5c75cf7564c19bb7b40d86ba9d360ebb040
SHA5123a87c279fbbbaff2bfe791c523716ad092c41099b8914ba369565014502d408084259d4efe6896d785c024935b181ca34cf49e3b79f3f1a89ee1c9d775635d94
-
Filesize
862KB
MD5c2526d46e23a811c40b13b1b5bf6602a
SHA1213fa42ca98b2038dd859a441e4459d332a7d029
SHA256ae22f1cffbe662f1d51075d28054476064e161cd4e2988f6ece292ded4a7814c
SHA512167dce70215c14cb5b8dcae4e1b69e0aa2fde70710ff419bbfb818e333264607fc9267e7d3ec0f3dad7e4fe3bee94bf43106533c480a8419b142d97ef42f0a3c
-
Filesize
862KB
MD5c2526d46e23a811c40b13b1b5bf6602a
SHA1213fa42ca98b2038dd859a441e4459d332a7d029
SHA256ae22f1cffbe662f1d51075d28054476064e161cd4e2988f6ece292ded4a7814c
SHA512167dce70215c14cb5b8dcae4e1b69e0aa2fde70710ff419bbfb818e333264607fc9267e7d3ec0f3dad7e4fe3bee94bf43106533c480a8419b142d97ef42f0a3c
-
Filesize
55KB
MD56853cba3ccc11699c2d840f41c10393f
SHA180a430dcc2cb34b05d433f0f63b8ef8a6a09bbe3
SHA2560bcf3f4ff7862cd885003b8ecc4d424a2fd418fd64412ffe95a9c4221cc3de59
SHA512a02fef8b7c721459fa6f081a1208bf8dd84d957663b4d711b9f6f1731deedf977e5a391ec7481797da7a594c3dd133e84865133855dcdbe6da2128887270114c
-
Filesize
55KB
MD56853cba3ccc11699c2d840f41c10393f
SHA180a430dcc2cb34b05d433f0f63b8ef8a6a09bbe3
SHA2560bcf3f4ff7862cd885003b8ecc4d424a2fd418fd64412ffe95a9c4221cc3de59
SHA512a02fef8b7c721459fa6f081a1208bf8dd84d957663b4d711b9f6f1731deedf977e5a391ec7481797da7a594c3dd133e84865133855dcdbe6da2128887270114c
-
Filesize
55KB
MD56853cba3ccc11699c2d840f41c10393f
SHA180a430dcc2cb34b05d433f0f63b8ef8a6a09bbe3
SHA2560bcf3f4ff7862cd885003b8ecc4d424a2fd418fd64412ffe95a9c4221cc3de59
SHA512a02fef8b7c721459fa6f081a1208bf8dd84d957663b4d711b9f6f1731deedf977e5a391ec7481797da7a594c3dd133e84865133855dcdbe6da2128887270114c
-
Filesize
150B
MD567e4ea2c3e65d3236c8266b9c116f67f
SHA17e87f925ccd68b2b7c9af9f92e118db1990234f9
SHA2562dff6c390d03870cec06d16fe0191475fb87ad2330b78d03c15e7ff0bed8f00c
SHA5121a3cf0443e932b9b57f32531b3d61c917b9eec19a4ba73336011041e16a0022c5e62b2c768b34a0bdc08ffd75bbaa0338719577001496c9de8a5638420b0a229