Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

ac10542bf4...e6.exe

windows7-x64

8

ac10542bf4...e6.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 09:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe

  • Size

    153KB

  • MD5

    88034087b4e9678846bc64b34128f020

  • SHA1

    935ee25e1d746c891277fbaf4e6f3cbbedb28d2e

  • SHA256

    ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6

  • SHA512

    43e055f251d39915836828c7c3f36efbe1dfa4eb62ae5d993dee5377dfbbaf826278972960d630609bf333147a229d12e5321df792d1ba67a1e1663572dc70c9

  • SSDEEP

    3072:PQHbkEVizHGn9HV6HutTBfAUOjLx6CidbkoFvFtyySyUnXgsQG:PQHbkEVizHGn9HAHutTB7O04olT/SyUH

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
    "C:\Users\Admin\AppData\Local\Temp\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Users\Admin\AppData\Local\Temp\240602546\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
      "C:\Users\Admin\AppData\Local\Temp\240602546\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4300

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\240602546\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
    Filesize

    47.5MB

    MD5

    95900369c2d4d5799297b71814b71e23

    SHA1

    dc97a08e591bee17a468273cc9c4906cc22aec5e

    SHA256

    c184a789c119f6c5371c6d62eae70baf2f2a364337cd8a30267aea4d3f65ca3f

    SHA512

    fdb7bea5d79c3398a65da337c8875b0b8e9a76e4bd7e111f842cf76c86e9fa1d52f1cdfb93e1503c92c166dcd8857dbcc9582225d750504f176555f3e27ceef4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\240602546\ac10542bf451cdf6be212398546ede927e0bdb628b22e6e774fef3c2a3d0abe6.exe
    Filesize

    47.5MB

    MD5

    95900369c2d4d5799297b71814b71e23

    SHA1

    dc97a08e591bee17a468273cc9c4906cc22aec5e

    SHA256

    c184a789c119f6c5371c6d62eae70baf2f2a364337cd8a30267aea4d3f65ca3f

    SHA512

    fdb7bea5d79c3398a65da337c8875b0b8e9a76e4bd7e111f842cf76c86e9fa1d52f1cdfb93e1503c92c166dcd8857dbcc9582225d750504f176555f3e27ceef4

    Download Submit