Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
05/12/2022, 22:33
General
-
Target
99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe
-
Size
26KB
-
MD5
3a8ee9a41b0259d5301dedf16aa97da2
-
SHA1
28dd02497be450521e16ae772e99e3399835542d
-
SHA256
99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05
-
SHA512
bf4ec4c0d39e4bfd451c887bc7734441900568f34141ec3e92de644077acf5696411c966a2339ee67799d80248170530e2c62d47b94f985b3a6802691d953a4f
-
SSDEEP
384:1M3PnQoHDCpHf4I4Qwdc0G5KDJgSxKYDvHv9TmjX2d:1m/QojCpHfx0gSxTlWX2d
Malware Config
Signatures
-
Drops file in Drivers directory 6 IoCs
-
Executes dropped EXE 4 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 3 IoCs
-
Drops desktop.ini file(s) 24 IoCs
-
Drops autorun.inf file 1 TTPs 27 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe"C:\Users\Admin\AppData\Local\Temp\99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\drivers\winlogon.exe"C:\Windows\System32\drivers\winlogon.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Drops autorun.inf file
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\AE 0124 BE.exe"C:\Windows\AE 0124 BE.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\drivers\winlogon.exe"C:\Windows\System32\drivers\winlogon.exe"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\drivers\winlogon.exe"C:\Windows\System32\drivers\winlogon.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD595f3aaef82d221904b2027425d996b62
SHA1a94509c7be084c4f8b6aef50a77a646be1517c73
SHA256c5e8cdac0cf7bd88e49de51f0ae641c424466f187e84065f655b44a6b3c08b35
SHA512b99cbe4631bd36757f682808a2325a8f34093ceb7e57c9e9839068448caf11fb7e20ac74b31c4bb405f50c7bf616e9030d1b2cb8ea7b4ff06db03ca433769da0
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
25B
MD5589b6886a49054d03b739309a1de9fcc
SHA10ec1dff7a03f13dea28eea5e754d5b0e5e1dc308
SHA256564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8
SHA5124b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb
-
Filesize
25B
MD5589b6886a49054d03b739309a1de9fcc
SHA10ec1dff7a03f13dea28eea5e754d5b0e5e1dc308
SHA256564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8
SHA5124b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb
