Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
05/12/2022, 07:58
General
-
Target
ba4095b52bd5f8e05596d22cf99d642e783b5022d611119c6c06e0267f0f1c4c.exe
-
Size
44.1MB
-
MD5
da59050c06f96b5375c806af9d178fa1
-
SHA1
c974765db3b9b3936acc0bd2c48fe2b9f8ddb2e1
-
SHA256
ba4095b52bd5f8e05596d22cf99d642e783b5022d611119c6c06e0267f0f1c4c
-
SHA512
a19328c05c7d97a21b0126e8ee0cea72442221ae6569f0c03b814d1e2bb494e51849974818a8ca9aface697610965ac6dbe248e49633ff9212f0e521160e8681
-
SSDEEP
196608:EN+0S3Q6CabWI9zp7KZ3RjH8pYWkcvZJfhGkmb:EM0S3Q6CaiI6ZJ8pYAvZJk
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops file in Program Files directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba4095b52bd5f8e05596d22cf99d642e783b5022d611119c6c06e0267f0f1c4c.exe"C:\Users\Admin\AppData\Local\Temp\ba4095b52bd5f8e05596d22cf99d642e783b5022d611119c6c06e0267f0f1c4c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Hiurt686\objectrescue.pro.v5.1.490.winall.keygen.and.patch-brd_setup.exeC:\Users\Admin\AppData\Local\Temp\Hiurt686\objectrescue.pro.v5.1.490.winall.keygen.and.patch-brd_setup.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\g8E1AA\ObjectRescue.Pro.v5.1.490.WinALL.Keygen.and.Patch-BRD_setup.exeC:\Users\Admin\AppData\Local\Temp\g8E1AA\ObjectRescue.Pro.v5.1.490.WinALL.Keygen.and.Patch-BRD_setup.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22.0MB
MD518410294a8218f0a0642e0fa2e53fd4f
SHA172446bf0d5ce2553382ecc856db5c13c0cb14fe3
SHA2569868637f89bad81c4c5e7ce224b3ea899cb9993dfb1a567262a7b16fd32299da
SHA5127c7032d773f934430870e680bf58aebe22c69740cf433f05d79da961b071913d51d36ac00c0326224150e38aa63260686590d48d41c45811177f1c33de229798
-
Filesize
22.0MB
MD518410294a8218f0a0642e0fa2e53fd4f
SHA172446bf0d5ce2553382ecc856db5c13c0cb14fe3
SHA2569868637f89bad81c4c5e7ce224b3ea899cb9993dfb1a567262a7b16fd32299da
SHA5127c7032d773f934430870e680bf58aebe22c69740cf433f05d79da961b071913d51d36ac00c0326224150e38aa63260686590d48d41c45811177f1c33de229798
-
Filesize
180KB
MD530bde9c271b5749920c2da98bb0b8099
SHA1ca8a97ef55224c91f3fa31d807679b6104ecf9a6
SHA256b003d1d803ab3574734f7570ad5426d53851e091759cce7f7908861bf2febd1f
SHA512ad1e622fd5171c38756070bfc7fb2137d0bc0b7a294e85700107bb031bf227bba3e675d4eb83e4d45551b0954d4e9aa44752f545a719b564d6a1002d541c6f57
-
Filesize
180KB
MD530bde9c271b5749920c2da98bb0b8099
SHA1ca8a97ef55224c91f3fa31d807679b6104ecf9a6
SHA256b003d1d803ab3574734f7570ad5426d53851e091759cce7f7908861bf2febd1f
SHA512ad1e622fd5171c38756070bfc7fb2137d0bc0b7a294e85700107bb031bf227bba3e675d4eb83e4d45551b0954d4e9aa44752f545a719b564d6a1002d541c6f57