Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 00:08
Static task
static1
Behavioral task
behavioral1
Sample
6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce.exe
Resource
win10v2004-20220901-en
General
-
Target
6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce.exe
-
Size
45KB
-
MD5
3d084b92117a693c81bf256a9782ddb0
-
SHA1
dc50c7aad3f4cbd3d4f89474ab78cea9df41f8e9
-
SHA256
6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce
-
SHA512
28716bc5fd69fa7d8cb03de1b500e878ec4793a9206bff25135df80d8966cbd5b92e57de81f86ea5ebd000426cb585f00084986993b672e01e63818bc5d939db
-
SSDEEP
768:kq3hpv8eDKxNS0cGbQrq9OSiT532YdD581k46HZxjH/Aqvtu1SBYr1pTqNjALqH4:9qulG9ktZ9/KdNqhHCCrkRX4C
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1020 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4500 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe 1020 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1020 Trojan.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1020 1516 6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce.exe 81 PID 1516 wrote to memory of 1020 1516 6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce.exe 81 PID 1516 wrote to memory of 1020 1516 6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce.exe 81 PID 1020 wrote to memory of 4500 1020 Trojan.exe 82 PID 1020 wrote to memory of 4500 1020 Trojan.exe 82 PID 1020 wrote to memory of 4500 1020 Trojan.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce.exe"C:\Users\Admin\AppData\Local\Temp\6c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:4500
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD53d084b92117a693c81bf256a9782ddb0
SHA1dc50c7aad3f4cbd3d4f89474ab78cea9df41f8e9
SHA2566c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce
SHA51228716bc5fd69fa7d8cb03de1b500e878ec4793a9206bff25135df80d8966cbd5b92e57de81f86ea5ebd000426cb585f00084986993b672e01e63818bc5d939db
-
Filesize
45KB
MD53d084b92117a693c81bf256a9782ddb0
SHA1dc50c7aad3f4cbd3d4f89474ab78cea9df41f8e9
SHA2566c42459c1638b6eaa783c9cbf6886761c6e8e9cd11c891abc34d664e539dffce
SHA51228716bc5fd69fa7d8cb03de1b500e878ec4793a9206bff25135df80d8966cbd5b92e57de81f86ea5ebd000426cb585f00084986993b672e01e63818bc5d939db