Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 23:27
Behavioral task
behavioral1
Sample
e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe
Resource
win10v2004-20220812-en
General
-
Target
e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe
-
Size
1.2MB
-
MD5
d47395885a6c44a916212dcf8cef180e
-
SHA1
8ae9094b2bfb79dc020d4139d823f12124cf56d3
-
SHA256
e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6
-
SHA512
5313c5be4b2b61bda4993cb75c44d1b51ae6f5c8a1e9f2bab0491461411373e0543c1e9d6bb10c6bdd0539b8702e84c3340aa3ab4432f69d0341d6c6690d829f
-
SSDEEP
24576:WD0tM85tbNJjldeYiY39Ox7MKEZH+5jOTWGyG:WD0tM85DJjl/iqN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3988 Sdat.exe -
resource yara_rule behavioral2/memory/4700-137-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral2/memory/4700-139-0x0000000000400000-0x00000000004DF000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4700-137-0x0000000000400000-0x00000000004DF000-memory.dmp autoit_exe behavioral2/memory/4700-139-0x0000000000400000-0x00000000004DF000-memory.dmp autoit_exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\PCGWIN32.LI5 Sdat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{438FA796-37355315-F37E4574-60462D04} Sdat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{438FA796-37355315-F37E4574-60462D04}\ = 4f31d83173c1bb505b8944527d01227e69e2b67e5ae307f85466c53b1a58bfb923e1c0b1029187852baa88a832d6d7847bc8d810f9071ab400d9973e8b6308100c39d35abffe232260b95121fec69d7b01e7cafb481f317caa6391d0318f6a4cd7d0fbbed81cfc019c82be61a2aec9d3d2c7097b2d206eb313a0001222e250517d926178cadd96fe0a6211c18509e98e11ed4212d107318b9ef7c36b60a8bb56744b3b70581dc67e2a9d5742c41126b9eba5ef058c1a6f798c1a1138bde55de9c24d8ece2c722d9191fdf19d51bd729d99c27a911fb2bcd7a2841e47c3940ff98ca2edb632a457a8f4892952f2f8dee0fc44a22b80904386384add0902ea972e3bf398a73c2b9d680197fa4b60683d77e26b0ef06dea4e11f3f290a94312d73efba35faffc2c5cf3bd201d80be1a5d79829a3f7ea31d1f7e7c9d9f81832ef00cdfefc3f3a7978bbbd7604b4dc80e5273bfe7232be0b0d01cf9c3d9187dbd225eb97ca65dfb7ea0e3a2985e7d3da2de300297b70b5b90780c61cf511336802b5610450d4ace76522b0108b60ba43065e126a2950685353956e6c51426875524ca67f05b1cf83fda9c01fdd21e4703cbe8d76c0b3108aa4dae12134737a494fb46605b78405915064a2b91d0728d602e370cd48dca6d7672251186f68ae52ea6cd942db692643ff75c94bdf59de601e4fa781e2343b85865fdaae171d516b9f59d16becb6350d73ffba3674fc4ec5652b58715c4c6778d729dfd7318f6473791c0bd999b34c006379c76ff0738131f10818c9fb977062ae0b759a127cf8d95237bd0d5b61454b9b7e6eb0597eabbb160e23d66a2abf737dbe407c6e4bb7a4c1981fe3a62e149c196c9f5f5d5aa096f0a8ccf1193faffe663aaa0880588899369b792eb76af1bf3f8271c24c1f77d5be200e79304c8791361f8ead8b6c45ac4817b31205ee383209855044527b674641bd538852769e4b2562e7badd81185c63a54593782d4be48220f01ac8292794e590d3aaedfb2c311b739dba27f88dc0f03ecafcc3392508e71929af1bfa223ff701ce101e58dea91ce0d721251887aee1f32035fd03cc221562acb2f08139478ca5d08be75e2d69034bed7a38b48f7f65b94b838df1dbc82e1511a45074ad451440a69cfae0cb2d117820b69e8ae8a0d6e916d05327a2f67eca4d355470604d569ca4ea9ad95edb9b1655dea82b7d6148a7990617fd21cf6831bd000f49858be391ca27da1a2c6bf5a5c87fccba26f26ac750c96adb4ce2b2dd0ee3bcca7f20bd69045073a64a6668485f4459ae6bea49d1a7e07dc648027eec4d20bc87055603aadd9913e0d5d2e3e4d1c323f261c353ddae28668f411687aeb990881e90df15295b7b9d4d9bbbda061c9fe75dda67df41e684369984abc0f22332fd0b3f8d79c3bbe605dd33ef79d14c2c727941b7bb89898017d952239e79e3403eb6090723be11f8dfc31de12bc7fdc1c3c3e1f23bce09cbe7c225d373e64233708d4d5768a2b0890ef84330be02f8cec6ece534cf8cf9d0cfeace330e7ab5b083892e34e67b3345797f4c46809b5ce16b3cb1ff7fcab624f21acb62c95d1ca095072c96715e4b6f82b1e8f3d33e268585747f4cbd497f8fbdc277f5463f5b0295eca3da8a22ca8cd2d12ceffd25c803d4ee253370864317a1ad93e85631548ca6911cab28f286cb5eed9b23d1ee27d9e6202a9e18a3628a5093552e6073a04e1f9659e1a43bf985c7f81dc42bdd95e45c286b604dacbc6cf2a8c0f93acf0b0ab6c681389b8eea6cc1532fad9d881fe25a26a985741c4468bf4376414fb4520da59793a9e21437a6fe66c144f450cc6d1cafaef9fac83aebf4c637310284b57f0c42b774894f777eb243745d4967ab4e7e824cca7f064ad7a5219873e1463cb08f7f3eb17b774ab19b0feae62ac07b04497b574ea2751547df69e2a426f110cc62dd452463fd51c49018e311212810f5e4cc351478e64b2f52856ed8511258a7a099f89832d27921431865ec4834487b51b19c046e48ba7e8b44daa7190568235bf665c9503b58fdab3ff271c343e57a3044fe58c3a0ea6532af08f2d4cb1cf11ac4a4d91f1b9ddde3dfd22ddbf415c7a42a741947608252f164c45333618e50345d846bbbb27e7c4bb489f117c861d85feeae3afb86ca0eca8ee483211694a52f1cf528cce5332b09fe303a8d86d01edeacd6f11f33aef5f337c109dbbc260f85c647f575c843f65dce6c3547f4b1cc8bd8da1ee360de56e0af38818d4f9389a23f99861c5f216663babd83078aa656886f1da59c64665f44596a6c444eaebc897534b7fd05c873dd422c53706e42aa9b7eaab1770c45be4c7caabc8174b0477c594fa44583b3b9898b88067731450b7f29ba87f081c49bfaaa39048c32ba0a8a78e9b32bf11a3bae09ebf42dc573dc462abd1080216e9f58ea51279379ea47c87e1d45d74be97ddcb7e6fa36c3f719c613c2eddf37ee7236bafd07370a8652ca6ef9a3307601b0dc0cefe6c62330190a2b69e64026bf110e97bd6d88b03e8984e06f3956735a496c5cb562885104a8b68b7536440372194e6bad51eb6fdaa1db67e64233b1860c5e7ba145f877c44e2a9aeee0c934d8f5293b1b79ae47fb51cdabcc160c19f750356d84b3c105f0a7c37e1d4d94a05492ac99751f4c225111672bad9de3e3ca2631000833f701cef7f535cb0bfdedc42bd5f5ebc835f373c94e3f8e8de914381184dff321ce97fd5637588ea682917cab4a9aa1571c6660aead76ebbd367f0b466282beb90cfb8cc1bb1c0dede7c829d563d75e2e63e6ba3f7c8eb492f964c0a1191c6096a964f34f39ba73f2b9c483c91df81032290103efddde17e5523368795abf6f7d4ab34af15acc653ba38e0634acfd7537bc860eb9310cf7bf32058f7075bbb005fa3bcd7223bc9e0f1cadae9b992e6cf742ca710ebb5af99d33e071c64bdf761dbaac0c8a9d4f64b2b57d074852735342a2b4f37ec2431f76a5bd77834e6db8ab816df053cb61c5b83b88fe36c9013b68854e9052a9a2886755b6a788f23f30fdfcc3cd2e1708ee50d5552b6811a8187d964fd89e15656057aca992fb98c591202c97711d4ca494e8e0d328eaf4dd3ee378d24119b36bfa52386d03a0e616dda72c0d9e1ba9e61fd9a6106fa555eba83de0082c3aec7b28b978fbbf3a7578bb488276b9b104773a4a00a86b1f416a675ca9ad67904226b9e707c97a1445129f2aa9090487aeb27e8b468a83169a22e86ad2bf2f0d8ec44ec49eeb6536b473044e725f41a6607e5f46999b2fa2f5eb383270784d4150a7ab760d493074724c4d94686752ae91149b696e50446bb6ae071d22a4e6933b6e864146b8930ce21137638dae14661b51e697d0ea293f8709895b836da948076a09bb53f95dc853e65a33a3859a0c65a6bf988a5575534b6aa149075f49694f58a56898b5670ca1dd0427aeee7726be950ce832dbf6e1c2dc12d2ace8e8c2c6e516d822e9e7303a03f4edc0dc2b27e5fddfc7d5e9ebdfcdd607d459eb63c55a3fae0a7f87420d8e9f8a91c357d6622951945064adb117f0a5c6fbd2c9d323e2722e49f764315a08a00907d76a255d10a4e69b3b2686854714b2608152d050e0acdf171a95ae98771eb9e Sdat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{438FA796-37355315-F37E4574-60462D04}\ = 3facdc3973c1bb505b8944527d01227e69e2b67e5ae307f85466c53b1a58bfb923e1c0b1029187852baa88a832d6d7847bc8d810f9071ab400d9973e8b6308100c39d35abffe232260b95121fec69d7b01e7cafb481f317caa6391d0318f6a4cd7d0fbbed81cfc019c82be61a2aec9d3d2c7097b2d206eb313a0001222e250517d926178cadd96fe0a6211c18509e98e11ed4212d107318b9ef7c36b60a8bb56734b3b70581dc67e2a9d5742c41126b9eba5ef058c1a6f798c1a1138bde55de9c24d8ece2c722d9191fdf19d51bd729d99c27a911fb2bcd7a2841e47c3940ff98ca2edb632a457a8f4892952f2f8dee0fc44a22b80904386384add0902ea972e3bf398a73c2b9d680197fa4b60683d77e26b0ef06dea4e11f3f290a94312d73efba35faffc2c5cf3bd201d80be1a5d79829a3f7ea31d1f7e7c9d9f81832ef00cdfefc3f3a7978bbbd7604b4dc80e5273bfe7232be0b0d01cf9c3d9187dbd225eb97ca65dfb7ea0e3a2985e7d3da2de300297b70b5b90780c61cf511336802b5610450d4ace76522b0108b60ba43065e126a2950685353956e6c51426875524ca67f05b1cf83fda9c01fdd21e4703cbe8d76c0b3108aa4dae12134737a494fb46605b78405915064a2b91d0728d602e370cd48dca6d7672251186f68ae52ea6cd942db692643ff75c94bdf59de601e4fa781e2343b85865fdaae171d516b9f59d16becb6350d73ffba3674fc4ec5652b58715c4c677d31c9ffd7318f6473791c0bd999b34c006379c76ff0738131f10818c9fb977062ae0b759a127cf8d95237bd0d5b61454b9b7e6eb0597eabbb160e23d66a2abf737dbe407c6e4bb7a4c1981fe3a62e149c196c9f5f5d5aa096f0a8ccf1193faffe663aaa0880588899369b792eb76af1bf3f8271c24c1f77d5be200e79304c8791361f8ead8b6c45ac4817b31205ee383209855044527b674641bd538852769e4b2562e7badd81185c63a54593782d4be48220f01ac8292794e590d3aaedfb2c311b739dba27f88dc0f03ecafcc3392508e71929af1bfa223ff701ce101e58dea91ce0d721251887aee1f32035fd03cc221562acb2f08139478ca5d08be75e2d69034bed7a38b48f7f65b94b838df1dbc82e1511a45074ad451440a69cfae0cb2d117820b69e8ae8a0d6e916d05327a2f67eca4d355470604d569ca4ea9ad95edb9b1655dea82b7d6148a7990617fd21cf6831bd000f49858be391ca27da1a2c6bf5a5c87fccba26f26ac750c96adb4ce2b2dd0ee3bcca7f20bd69045073a64a6668485f4459ae6bea49d1a7e07dc648027eec4d20bc87055603aadd9913e0d5d2e3e4d1c323f261c353ddae28668f411687aeb990881e90df15295b7b9d4d9bbbda061c9fe75dda67df41e684369984abc0f22332fd0b3f8d79c3bbe605dd33ef79d14c2c727941b7bb89898017d952239e79e3403eb6090723be11f8dfc31de12bc7fdc1c3c3e1f23bce09cbe7c225d373e64233708d4d5768a2b0890ef84330be02f8cec6ece534cf8cf9d0cfeace330e7ab5b083892e34e67b3345797f4c46809b5ce16b3cb1ff7fcab624f21acb62c95d1ca095072c96715e4b6f82b1e8f3d33e268585747f4cbd497f8fbdc277f5463f5b0295eca3da8a22ca8cd2d12ceffd25c803d4ee253370864317a1ad93e85631548ca6911cab28f286cb5eed9b23d1ee27d9e6202a9e18a3628a5093552e6073a04e1f9659e1a43bf985c7f81dc42bdd95e45c286b604dacbc6cf2a8c0f93acf0b0ab6c681389b8eea6cc1532fad9d881fe25a26a985741c4468bf4376414fb4520da59793a9e21437a6fe66c144f450cc6d1cafaef9fac83aebf4c637310284b57f0c42b774894f777eb243745d4967ab4e7e824cca7f064ad7a5219873e1463cb08f7f3eb17b774ab19b0feae62ac07b04497b574ea2751547df69e2a426f110cc62dd452463fd51c49018e311212810f5e4cc351478e64b2f52856ed8511258a7a099f89832d27921431865ec4834487b51b19c046e48ba7e8b44daa7190568235bf665c9503b58fdab3ff271c343e57a3044fe58c3a0ea6532af08f2d4cb1cf11ac4a4d91f1b9ddde3dfd22ddbf415c7a42a741947608252f164c45333618e50345d846bbbb27e7c4bb489f117c861d85feeae3afb86ca0eca8ee483211694a52f1cf528cce5332b09fe303a8d86d01edeacd6f11f33aef5f337c109dbbc260f85c647f575c843f65dce6c3547f4b1cc8bd8da1ee360de56e0af38818d4f9389a23f99861c5f216663babd83078aa656886f1da59c64665f44596a6c444eaebc897534b7fd05c873dd422c53706e42aa9b7eaab1770c45be4c7caabc8174b0477c594fa44583b3b9898b88067731450b7f29ba87f081c49bfaaa39048c32ba0a8a78e9b32bf11a3bae09ebf42dc573dc462abd1080216e9f58ea51279379ea47c87e1d45d74be97ddcb7e6fa36c3f719c613c2eddf37ee7236bafd07370a8652ca6ef9a3307601b0dc0cefe6c62330190a2b69e64026bf110e97bd6d88b03e8984e06f3956735a496c5cb562885104a8b68b7536440372194e6bad51eb6fdaa1db67e64233b1860c5e7ba145f877c44e2a9aeee0c934d8f5293b1b79ae47fb51cdabcc160c19f750356d84b3c105f0a7c37e1d4d94a05492ac99751f4c225111672bad9de3e3ca2631000833f701cef7f535cb0bfdedc42bd5f5ebc835f373c94e3f8e8de914381184dff321ce97fd5637588ea682917cab4a9aa1571c6660aead76ebbd367f0b466282beb90cfb8cc1bb1c0dede7c829d563d75e2e63e6ba3f7c8eb492f964c0a1191c6096a964f34f39ba73f2b9c483c91df81032290103efddde17e5523368795abf6f7d4ab34af15acc653ba38e0634acfd7537bc860eb9310cf7bf32058f7075bbb005fa3bcd7223bc9e0f1cadae9b992e6cf742ca710ebb5af99d33e071c64bdf761dbaac0c8a9d4f64b2b57d074852735342a2b4f37ec2431f76a5bd77834e6db8ab816df053cb61c5b83b88fe36c9013b68854e9052a9a2886755b6a788f23f30fdfcc3cd2e1708ee50d5552b6811a8187d964fd89e15656057aca992fb98c591202c97711d4ca494e8e0d328eaf4dd3ee378d24119b36bfa52386d03a0e616dda72c0d9e1ba9e61fd9a6106fa555eba83de0082c3aec7b28b978fbbf3a7578bb488276b9b104773a4a00a86b1f416a675ca9ad67904226b9e707c97a1445129f2aa9090487aeb27e8b468a83169a22e86ad2bf2f0d8ec44ec49eeb6536b473044e725f41a6607e5f46999b2fa2f5eb383270784d4150a7ab760d493074724c4d94686752ae91149b696e50446bb6ae071d22a4e6933b6e864146b8930ce21137638dae14661b51e697d0ea293f8709895b836da948076a09bb53f95dc853e65a33a3859a0c65a6bf988a5575534b6aa149075f49694f58a56898b5670ca1dd0427aeee7726be950ce832dbf6e1c2dc12d2ace8e8c2c6e516d822e9e7303a03f4edc0dc2b27e5fddfc7d5e9ebdfcdd607d459eb63c55a3fae0a7f87420d8e9f8a91c357d6622951945064adb117f0a5c6fbd2c9d323e2722e49f764315a08a00907d76a255d10a4e69b3b2686854714b2608152d050e0acdf171a95ae98771eb9e Sdat.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3124 PING.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4700 wrote to memory of 3988 4700 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 80 PID 4700 wrote to memory of 3988 4700 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 80 PID 4700 wrote to memory of 3988 4700 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 80 PID 4700 wrote to memory of 1352 4700 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 81 PID 4700 wrote to memory of 1352 4700 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 81 PID 4700 wrote to memory of 1352 4700 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 81 PID 1352 wrote to memory of 3124 1352 cmd.exe 83 PID 1352 wrote to memory of 3124 1352 cmd.exe 83 PID 1352 wrote to memory of 3124 1352 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe"C:\Users\Admin\AppData\Local\Temp\e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Roaming\Sdat.exeC:\Users\Admin\AppData\Roaming\Sdat.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:3988
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 0.0.0.1 -n 1 -w 1000 & del e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\PING.EXEping 0.0.0.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:3124
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD563f5cafa5db0ea7725a1f88126e79c69
SHA16045945dabbc10e8503993bf487d10f9268d55d7
SHA256d4b7886c31121eb3ac9dee85367959273700d6617cf19c0c1eabd4b396679b94
SHA512a2569e2cf97fbb6bcfcb35c56f2bb7047b49c8cb81e5c95a39a502199b67f1893043096b26cf837ffd618999de54400ee804f10d7f6df5035e6a61f98cf66c6c
-
Filesize
219KB
MD563f5cafa5db0ea7725a1f88126e79c69
SHA16045945dabbc10e8503993bf487d10f9268d55d7
SHA256d4b7886c31121eb3ac9dee85367959273700d6617cf19c0c1eabd4b396679b94
SHA512a2569e2cf97fbb6bcfcb35c56f2bb7047b49c8cb81e5c95a39a502199b67f1893043096b26cf837ffd618999de54400ee804f10d7f6df5035e6a61f98cf66c6c