Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 11:36

General

  • Target

    5efce78a14dbe10b6787f5bd1f2ad2c2fa17e12d61431b16b13ddfc383304046.exe

  • Size

    140KB

  • MD5

    0d0aac5cc047ede373f422fc60916e00

  • SHA1

    ee482dfaca0b95ba3481f4d1264d0a46907d707a

  • SHA256

    5efce78a14dbe10b6787f5bd1f2ad2c2fa17e12d61431b16b13ddfc383304046

  • SHA512

    ef9e228f0bb876b43bd1430e8c4ae8e11878f8cf8c796a8b2e1598ddc15b44f7e0beb2caec395ed42ee447e5607736e5e62de2e75c91c580f51dadfacf1c0d68

  • SSDEEP

    3072:s2LacOaPAX7EjWafJMgE/2DyRuBzMuDuf3tbFR9EBoPfnvZYn:XLYaI7EjWaLBzMsgJv

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5efce78a14dbe10b6787f5bd1f2ad2c2fa17e12d61431b16b13ddfc383304046.exe
    "C:\Users\Admin\AppData\Local\Temp\5efce78a14dbe10b6787f5bd1f2ad2c2fa17e12d61431b16b13ddfc383304046.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Users\Admin\pezop.exe
      "C:\Users\Admin\pezop.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2496

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\pezop.exe

    Filesize

    140KB

    MD5

    af14df4e15a7d4347d811c8b578578f4

    SHA1

    6287c6f06ac9754ba824a9792d36fafacab47a9c

    SHA256

    ece9654759e37582102965e94dc976a44cc9623863c4038471440c9501a1aad0

    SHA512

    342e8192a3f4944294a0dfc7df314216a96c4f45d3250cfb2fdac65314f13737518bc5178567f3776cbe8251187adbb7c51328f2b18690e2863b6dc0d2fe4e96

  • C:\Users\Admin\pezop.exe

    Filesize

    140KB

    MD5

    af14df4e15a7d4347d811c8b578578f4

    SHA1

    6287c6f06ac9754ba824a9792d36fafacab47a9c

    SHA256

    ece9654759e37582102965e94dc976a44cc9623863c4038471440c9501a1aad0

    SHA512

    342e8192a3f4944294a0dfc7df314216a96c4f45d3250cfb2fdac65314f13737518bc5178567f3776cbe8251187adbb7c51328f2b18690e2863b6dc0d2fe4e96