Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    160s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 17:00

General

  • Target

    9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe

  • Size

    517KB

  • MD5

    3b1ef9996f69c1b1313860d87be06830

  • SHA1

    6e8d1f50e50e3add074580a6ee4e2831bfc44496

  • SHA256

    9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9

  • SHA512

    3b3c263f467ed01bba6883b61ead2a52d82a5f2879cee72c8a9cd3b56c695bd0d0855960c9ff44e1d50da6241003311485ca82ce41830f2971aab1fbd72d10ae

  • SSDEEP

    12288:WuoEjlj6rHTNlf6O2dHfd1ngE9o9mUcqEo:WjExerRVTm1gJr

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe
    "C:\Users\Admin\AppData\Local\Temp\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\Launcher.exe
      C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\Launcher.exe /in="e9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe" /out="9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe" /psw="f52ae3cc3cc945dcb051cd6d4f381238" /typ=dec
      2⤵
      • Executes dropped EXE
      PID:3024
    • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe
      C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe /path="C:\Users\Admin\AppData\Local\Temp\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4444

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe

    Filesize

    387KB

    MD5

    09cbf630383f8167f6e1ca2d47a9bb8f

    SHA1

    14668af37c543af239f837b732d2f6d0f106ddc9

    SHA256

    e428909745311f6a6d35524be5bd02dc3ab84031e2fb2831d46cc184235f9df8

    SHA512

    b51191c65deec04e760d33452d629aa64378affec1b69f748ed8182a8748d11551817648485b2d4118dd1c05e1e2c32fa864c0d5f5f7f8946fc5fbe0a2841bf3

  • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe

    Filesize

    387KB

    MD5

    09cbf630383f8167f6e1ca2d47a9bb8f

    SHA1

    14668af37c543af239f837b732d2f6d0f106ddc9

    SHA256

    e428909745311f6a6d35524be5bd02dc3ab84031e2fb2831d46cc184235f9df8

    SHA512

    b51191c65deec04e760d33452d629aa64378affec1b69f748ed8182a8748d11551817648485b2d4118dd1c05e1e2c32fa864c0d5f5f7f8946fc5fbe0a2841bf3

  • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe.config

    Filesize

    690B

    MD5

    bca0ea75b6940aa86960d7b9098a5998

    SHA1

    3d57f82158ac72c7eb2e72ba19a80485d8103130

    SHA256

    5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

    SHA512

    260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

  • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\Launcher.exe

    Filesize

    105KB

    MD5

    eb689fb1a8fd87e93209cf3038404d68

    SHA1

    d00a4189642b4ae4d97f797c8fdf7dd35875a8b7

    SHA256

    b8e99c41b345cbb1c61d851a91fcefb209fb83c9a88354ec26545a4f17e6d3f2

    SHA512

    fa1e0c29d82d4804f1f79de5c464cf8091dac0f1e6563d75eef6537f82c76884746dc4a5419a9a3f51bc1d5283d1867485b5e4e9d52fe0d621f74994937f8a7c

  • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\Launcher.exe

    Filesize

    105KB

    MD5

    eb689fb1a8fd87e93209cf3038404d68

    SHA1

    d00a4189642b4ae4d97f797c8fdf7dd35875a8b7

    SHA256

    b8e99c41b345cbb1c61d851a91fcefb209fb83c9a88354ec26545a4f17e6d3f2

    SHA512

    fa1e0c29d82d4804f1f79de5c464cf8091dac0f1e6563d75eef6537f82c76884746dc4a5419a9a3f51bc1d5283d1867485b5e4e9d52fe0d621f74994937f8a7c

  • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\Launcher.exe.config

    Filesize

    340B

    MD5

    91629f6b28cbe2b52bb86cb5af3bdbca

    SHA1

    35fb57ac58c9eb0668f5832a588d9f81e040568b

    SHA256

    589c122996fadc118731c6f983c5d3b498c4b4b59700ea548f4cfb79e4eaaeeb

    SHA512

    f08382296696173784841a163c73c19e7bd674a08a053c0434d55696f45039721925e5d829e4bbbf71b07385d1b88c5ea241b8247eb0d81bf381205977bd14c5

  • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\e9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe

    Filesize

    387KB

    MD5

    bb69c224def7911412485974e0c5c976

    SHA1

    64eb730064ab2f342df48f5932811c9346e68c66

    SHA256

    8335c63a8b4c2db5fa3251176278d611cfa95d20c7b482819d7cfe767453a033

    SHA512

    3b2aca4bf1ca0b9254145c6e7942fde5bcc748a54335fe05100dda4e7d74db7d997d2199a166174cd92b121ed3a8308aafa854f684611e1bc7a5cba254cb3abd

  • C:\Users\Admin\AppData\Local\Temp\DM\9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9.exe\UL603B7jsSukJJ2\installer.exe

    Filesize

    517KB

    MD5

    3b1ef9996f69c1b1313860d87be06830

    SHA1

    6e8d1f50e50e3add074580a6ee4e2831bfc44496

    SHA256

    9f4b8581dc906e860f2e0cc768dacd66043a141ddeec89472b316c2c2a12b2d9

    SHA512

    3b3c263f467ed01bba6883b61ead2a52d82a5f2879cee72c8a9cd3b56c695bd0d0855960c9ff44e1d50da6241003311485ca82ce41830f2971aab1fbd72d10ae

  • C:\Users\Admin\AppData\Local\Temp\nsjAD0F.tmp\pwgen.dll

    Filesize

    16KB

    MD5

    a555472395178ac8c733d90928e05017

    SHA1

    f44b192d66473f01a6540aaec4b6c9ac4c611d35

    SHA256

    82ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e

    SHA512

    e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a

  • memory/3024-138-0x00000000732F0000-0x00000000738A1000-memory.dmp

    Filesize

    5.7MB

  • memory/3024-139-0x00000000732F0000-0x00000000738A1000-memory.dmp

    Filesize

    5.7MB

  • memory/4444-145-0x000000000100A000-0x000000000100F000-memory.dmp

    Filesize

    20KB

  • memory/4444-146-0x000000000100A000-0x000000000100F000-memory.dmp

    Filesize

    20KB

  • memory/4444-144-0x00007FFD9B770000-0x00007FFD9C1A6000-memory.dmp

    Filesize

    10.2MB