Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 00:14
Static task
static1
Behavioral task
behavioral1
Sample
8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe
Resource
win10v2004-20220901-en
General
-
Target
8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe
-
Size
189KB
-
MD5
0a62f67759e3ccb71f4e2968e8bd3020
-
SHA1
b4c5dc55dbd5fe6eb24349a26c60411d9f6a99e7
-
SHA256
8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57
-
SHA512
2a6894a6c9e676410ca2d7fa28a1298a709fecfcb004eb3196d14dd9ebf5b3c36af782b184e35db3931526fb88541f15c49d896666d9a8aec63d985057afc8af
-
SSDEEP
1536:/vVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjYSrowfFD:/vVQLIkLWeaA8KlCph99rowfFD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4864 jusched.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run 8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\a6775138\jusched.exe 8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe File created C:\Program Files (x86)\a6775138\a6775138 8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job 8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4900 wrote to memory of 4864 4900 8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe 81 PID 4900 wrote to memory of 4864 4900 8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe 81 PID 4900 wrote to memory of 4864 4900 8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe"C:\Users\Admin\AppData\Local\Temp\8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Program Files (x86)\a6775138\jusched.exe"C:\Program Files (x86)\a6775138\jusched.exe"2⤵
- Executes dropped EXE
PID:4864
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD57bdf61d37c9adf3e1c6937107016091f
SHA156b8e0c454f9dd16d508a04b3afa7e458453ac41
SHA2564c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0
SHA512ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1
-
Filesize
189KB
MD571908b4260ed94ced3f7997a25cdc461
SHA1fdd67c2043886f4d047e6efb7b6aea75c8461f7b
SHA256ef48cd9510f34a10d90545943ffbcd95be56eb398c7f4dd698b785539eea0680
SHA5124a3db74ac03efea364a88030b044e1738df73f1d9109b8c4590004b9e1da3c4e4b6ef631a9429ac922b8df96b893b7ea82b6e660c1812ca67060809f5cfa1fa4
-
Filesize
189KB
MD571908b4260ed94ced3f7997a25cdc461
SHA1fdd67c2043886f4d047e6efb7b6aea75c8461f7b
SHA256ef48cd9510f34a10d90545943ffbcd95be56eb398c7f4dd698b785539eea0680
SHA5124a3db74ac03efea364a88030b044e1738df73f1d9109b8c4590004b9e1da3c4e4b6ef631a9429ac922b8df96b893b7ea82b6e660c1812ca67060809f5cfa1fa4