Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 23:48

General

  • Target

    97e1074f043a24a5024a423c8df3d066b2cf8e9fa97ac5f05193983b886d5097.exe

  • Size

    897KB

  • MD5

    23fd931d0cef81aef91f4c48f3407d89

  • SHA1

    6954db9e61a607bf09fdc5bcc8c0596eddf8da50

  • SHA256

    97e1074f043a24a5024a423c8df3d066b2cf8e9fa97ac5f05193983b886d5097

  • SHA512

    449e9ad6b4e66c92262d36bfbc287a7914f25cb7e83009032c347ef811caea6a753495538192854ac8b4821353081403afb24b5c33e6b577cf35784061f03661

  • SSDEEP

    24576:s/2vK1q8V/tsTK13ZtFOnu1NF7WAZ0AXh8YK:sHV//13vYkF7DPY

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97e1074f043a24a5024a423c8df3d066b2cf8e9fa97ac5f05193983b886d5097.exe
    "C:\Users\Admin\AppData\Local\Temp\97e1074f043a24a5024a423c8df3d066b2cf8e9fa97ac5f05193983b886d5097.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Windows\SysWOW64\neopsearchinst.exe
      C:\Windows\system32\neopsearchinst.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3100
      • C:\Program Files (x86)\neopsearch\neopinst.exe
        "C:\Program Files (x86)\neopsearch\neopinst.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\neopsearch\unst.bat""
          4⤵
            PID:1676
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\97E107~1.EXE >> NUL
        2⤵
          PID:4168

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\neopsearch\neopinst.exe

        Filesize

        36KB

        MD5

        cb421e731a30e504085e47a08e285f60

        SHA1

        3eaaa778c00a98d0cc7c62274c098a8e4599bed6

        SHA256

        e3f9d70362ad2c683b41eda7680c2af4b5532dedcbc987016e9c9dcd77f8b828

        SHA512

        5a1d96e642e5c04200d90a2d596e9a532599603be25b221bef0d2a986f0f2205edca1d27a602c5293b1834edf78846970735f188af2e00e8406f167cb00e915e

      • C:\Program Files (x86)\neopsearch\neopinst.exe

        Filesize

        36KB

        MD5

        cb421e731a30e504085e47a08e285f60

        SHA1

        3eaaa778c00a98d0cc7c62274c098a8e4599bed6

        SHA256

        e3f9d70362ad2c683b41eda7680c2af4b5532dedcbc987016e9c9dcd77f8b828

        SHA512

        5a1d96e642e5c04200d90a2d596e9a532599603be25b221bef0d2a986f0f2205edca1d27a602c5293b1834edf78846970735f188af2e00e8406f167cb00e915e

      • C:\Program Files (x86)\neopsearch\neopsearch.dll

        Filesize

        117KB

        MD5

        d1bdf99fa3d622eeb3ea2c050acce5e3

        SHA1

        816e9171958b4605cf1307d75aecfa8125c9f29c

        SHA256

        23601c711c268e56baea4357bdf44198234d9cb3c83a6a7f1b4d1363bf80afae

        SHA512

        5bf8da15fe30c2bcf6243720e64a227cf772a4d2d200fcc1d7c285d8bef496375a6a4943a46e026f74bdb461ed58e6991f866f163bb9a5a94578975941cf1fdf

      • C:\Program Files (x86)\neopsearch\unst.bat

        Filesize

        193B

        MD5

        e04d3d98ba2d436d20c7af27e52acf49

        SHA1

        d025c43b2a8d58d1aa40b538ee41b43ad139cb05

        SHA256

        4c1a7c2d8f19ee2dda91d0247b73be5e8314cae393b51a87f392b9a8207078ce

        SHA512

        94fd9ff68d98735dc66f0a7f18e4309b4562324afe4a79f88898e786917f30e42d785bacd2ca42b0054a9e5f4379c395ab30b42b73f9ebd417f9cf22a949ec3a

      • C:\Windows\SysWOW64\MSINET.OCX

        Filesize

        113KB

        MD5

        40d81470a19269d88bf44e766be7f84a

        SHA1

        4030e8e94297bc0aa5139fe241e8cf8f8142d8d4

        SHA256

        dd1215f01b484e7842763302d42749d516963d9ac74e2fe8825a5eaba34f6229

        SHA512

        e4a39613cc32885b67f6219281fbf99f50018b5fd2886b5389cfa04dc9dc4ebfc46fca2b9e89586116094fa3a7600c20b2ca0fa3535dd2615739621856506864

      • C:\Windows\SysWOW64\MSINET.OCX

        Filesize

        113KB

        MD5

        40d81470a19269d88bf44e766be7f84a

        SHA1

        4030e8e94297bc0aa5139fe241e8cf8f8142d8d4

        SHA256

        dd1215f01b484e7842763302d42749d516963d9ac74e2fe8825a5eaba34f6229

        SHA512

        e4a39613cc32885b67f6219281fbf99f50018b5fd2886b5389cfa04dc9dc4ebfc46fca2b9e89586116094fa3a7600c20b2ca0fa3535dd2615739621856506864

      • C:\Windows\SysWOW64\MSINET.OCX

        Filesize

        113KB

        MD5

        40d81470a19269d88bf44e766be7f84a

        SHA1

        4030e8e94297bc0aa5139fe241e8cf8f8142d8d4

        SHA256

        dd1215f01b484e7842763302d42749d516963d9ac74e2fe8825a5eaba34f6229

        SHA512

        e4a39613cc32885b67f6219281fbf99f50018b5fd2886b5389cfa04dc9dc4ebfc46fca2b9e89586116094fa3a7600c20b2ca0fa3535dd2615739621856506864

      • C:\Windows\SysWOW64\VB6KO.DLL

        Filesize

        99KB

        MD5

        84742b5754690ed667372be561cf518d

        SHA1

        ef97aa43f804f447498568fc33704800b91a7381

        SHA256

        52b64e2bfc9ee0b807f2095726ace9e911bcd907054ac15686a4e7d2fd4dc751

        SHA512

        72ac19a3665a01519dac2ad43eb6178a66ad7f4e167f2a882cbca242978f8debe3e15d0e210c3b0391590699999f33a1fd5de4ca6559ff894b4e6cb4ac1415a0

      • C:\Windows\SysWOW64\neopsearchinst.exe

        Filesize

        855KB

        MD5

        4a1d7020f7f5e6366293639c38e8f08c

        SHA1

        a88b1ddcfd81c235494298386d9f9f452fbab9df

        SHA256

        af8aa82e3cd39b6058a406b2d6fef5b38ad0ca2f3a3c953c2bf3a64acb90c206

        SHA512

        9c36c808fbf9484cb9291e142a47f64409ded618b414cde284a46879bab7cd616f8c3469099ff0fa18741b1df8185525a1022f5a96469fab1e88f83fbc0b884b

      • C:\Windows\SysWOW64\neopsearchinst.exe

        Filesize

        855KB

        MD5

        4a1d7020f7f5e6366293639c38e8f08c

        SHA1

        a88b1ddcfd81c235494298386d9f9f452fbab9df

        SHA256

        af8aa82e3cd39b6058a406b2d6fef5b38ad0ca2f3a3c953c2bf3a64acb90c206

        SHA512

        9c36c808fbf9484cb9291e142a47f64409ded618b414cde284a46879bab7cd616f8c3469099ff0fa18741b1df8185525a1022f5a96469fab1e88f83fbc0b884b

      • C:\Windows\SysWOW64\vb6ko.dll

        Filesize

        99KB

        MD5

        84742b5754690ed667372be561cf518d

        SHA1

        ef97aa43f804f447498568fc33704800b91a7381

        SHA256

        52b64e2bfc9ee0b807f2095726ace9e911bcd907054ac15686a4e7d2fd4dc751

        SHA512

        72ac19a3665a01519dac2ad43eb6178a66ad7f4e167f2a882cbca242978f8debe3e15d0e210c3b0391590699999f33a1fd5de4ca6559ff894b4e6cb4ac1415a0