Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe
Resource
win10v2004-20220812-en
General
-
Target
bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe
-
Size
356KB
-
MD5
56bea14a8aa030c2833064841b1e49c4
-
SHA1
89dc8a1e36b5b0c42b08b7bdf82a0a0ccd5eb35d
-
SHA256
bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e
-
SHA512
654ee9568acae59601b6880b2a0c34460ab7934a808b621567f79f1500dcec531852916d308ecce7c70aada1b6a1b2a6eafd26c7836a2ca90cfb528d3b068fe7
-
SSDEEP
6144:TNXJz6ZQw9FsL57G2/+C+7VXfhSoSWmTh7dnc4z4Q/IueNfn1g5Tzz:ZZzQps7G2/j+BX+W8JnX0buehK5/z
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xtuhn = "C:\\Windows\\SysWOW64\\ttdinjecty.exe" bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ttdinjecty.exe -
Executes dropped EXE 1 IoCs
pid Process 4772 ttdinjecty.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ttdinjecty.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ttdinjecty.exe bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe File opened for modification C:\Windows\SysWOW64\ttdinjecty.exe bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4764 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4772 ttdinjecty.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3036 wrote to memory of 4772 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe 80 PID 3036 wrote to memory of 4772 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe 80 PID 3036 wrote to memory of 4772 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe 80 PID 3036 wrote to memory of 4928 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe 82 PID 3036 wrote to memory of 4928 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe 82 PID 3036 wrote to memory of 4928 3036 bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe 82 PID 4772 wrote to memory of 4764 4772 ttdinjecty.exe 84 PID 4772 wrote to memory of 4764 4772 ttdinjecty.exe 84 PID 4772 wrote to memory of 4764 4772 ttdinjecty.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe"C:\Users\Admin\AppData\Local\Temp\bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe"1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\ttdinjecty.exeC:\Windows\SysWOW64\ttdinjecty.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /flushdns3⤵
- Gathers network information
PID:4764
-
-
-
C:\Windows\SysWOW64\cmd.exe/c C:\Users\Admin\AppData\Local\Temp\~unins9609.bat "C:\Users\Admin\AppData\Local\Temp\bc3f97e08fc70c5e7663cdcc380bcf7ae0a2b81e5cd6b9907f5f7a8f49cdb86e.exe"2⤵PID:4928
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49B
MD59e0a2f5ab30517809b95a1ff1dd98c53
SHA15c1eefdf10e67d1e9216e2e3f5e92352d583c9ce
SHA25697ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32
SHA512e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42
-
Filesize
104KB
MD5f9fe7f1373a59bb9f229edb5f5e02ef9
SHA15dbbaf2287a32b5bfa3451011e8cc6952b28a8ee
SHA256e39110076e939049c795d4842384bc971c0b7913bfe52775711be2a4ebf3444d
SHA51207a905e91f8df3b496b23160c9a30a01e3b92d96b94976df9679df69f781ec94797ce028cae2aa0a8239e80b33a52703cc7886b46400c4afdcfa965d1f0807ae
-
Filesize
104KB
MD5f9fe7f1373a59bb9f229edb5f5e02ef9
SHA15dbbaf2287a32b5bfa3451011e8cc6952b28a8ee
SHA256e39110076e939049c795d4842384bc971c0b7913bfe52775711be2a4ebf3444d
SHA51207a905e91f8df3b496b23160c9a30a01e3b92d96b94976df9679df69f781ec94797ce028cae2aa0a8239e80b33a52703cc7886b46400c4afdcfa965d1f0807ae