Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
cd0e4cab67b7fd76ef5d6bdcb7f25a21.exe
Resource
win7-20221111-en
General
-
Target
cd0e4cab67b7fd76ef5d6bdcb7f25a21.exe
-
Size
342KB
-
MD5
cd0e4cab67b7fd76ef5d6bdcb7f25a21
-
SHA1
a27ade3067d85e7ed462266b503caed5ef89d3dc
-
SHA256
c71e8cd3e58eaeab5de7d296fa62fd6fcad415facc687629d71b25bab56550eb
-
SHA512
c3ae7c68e14ddd2064c926d419ca88531d0344868792b81f8daab42c63aa28a096781fbb0cf38fd367cbf64d94ef073c17d17cef762b5e99bb110ebe00345195
-
SSDEEP
6144:ZBnbr9ZL8bW6Bg1GzljLDEkYiDifeaOcpTlSxbJ3bzGUAR6ZTu:HfL8bQalnDlRexQxNSlR7
Malware Config
Extracted
formbook
f4ca
omFHB5ajfJi1UEIEV9XcoRw=
UBjJkmQPyprdhcFF/bdCWQ==
evGKkBUj1je+otcfpw==
KgvGVeOATSt3nug0BIOm2JvOQycB
Lv6o3K0r9aSjI0lr9fg1txw=
LH1jJb/HieQpsEdqWCQTvX2PmsDVIeg=
99dte0XauJfk6Xv+uQxJFgA1gMktBA==
21FkkGB9gMniDQw2ffu6
r4lKBM/q6TZwVZfS
F+14qHeVWi56KdQ=
BgWXRsVoICMvvQ==
I+EozFl0Uy56KdQ=
xoXCgEllKEbWfjFCCLo=
qo9G1lXvvGt5GkxrLQWw
ORNlYic0PJ2ip4geEFSv
Yj+GFpvFxy0uVYx1fLI/XQ==
XL+veIKPjOTe4fjvFs+n
D2JKVAfuakXCAyoEvw==
voWJU81tH56wvt/vImbCcgVd
dVEcwFrmb8bZ4vXvFs+n
CMlcaOUF6cB+8Bnm2Kc=
NpYV3moXNE+ZQ4f9nVGCSA==
/GRkjGd1acLHyeLvImbCcgVd
R52MlF+Ag+LtFr1QKa7Zf/5a
kVD/mSO1YK75pA==
5q3IANfo/JHiDww2ffu6
4i8RFOH2ACRdhzja
VLWOSRe00XX6sNsijPzqiiWfFgf1J+g=
qnsgRFL46lWG
xo1QHOyKS9rj4fjvFs+n
mIHZlAqzS6ymmpMCU1uyZgE=
WCtjiGCFl/4JTiJ0R60=
c0vpAtZ3fY7TeLfdcnASQg==
Y87Xlic9/1+q3g/pUArVoB4=
kKOsRsf05wBOd67a
dDmgYgOZZ0aCMVwgDha4bgc=
ieXCbvcCyja+otcfpw==
Fd0XQwkTHHaBmNDvImbCcgVd
PK/M6eM8xOwqvw==
Pf0q8MdfICMvvQ==
EO8aPQwf7z2Du+XvImbCcgVd
BeUisSg/Ql6uJcg=
ay2v2pz4gomTESLosQ==
AGjX3ak2B+FyQ9ZKrQ==
Du0y0UXomyoxT4/arA8Du3FvpwE=
xhV7OrDTdonq4fjvFs+n
9+s2xTlaW66p2IAAnVkDQA==
AuS2UeN4Nsvl5vo8J67Zf/5a
B1vK2590RiUuuw==
/709BIUfMCIln8sus2u2aAM=
BMpYckjp699wVZfS
Pf2AqIscEhlpHlnV18IvVQk=
RKUTxUbz/zFroN/LLq+kIdZM
IuuiQ9pj7ZzciLVPiks4Rxc=
0KBn8XAV7NNm2xPxuA==
nv7yBtDj4UNE/ju8er1EZSanBXfyLv4=
sBgf41X1vKTwUspTsg==
5bk4+oQWD+X01tBEqQ==
c08KjxWnau8DDSsESMKNI+P5G/6/sYjU6g==
RJiyeEVj/N3rhNAW3qU=
v6O7hhQxA//+Oyq2ms9DWQ==
7MdHCYCb4OT5pg==
Je0NLgIfKIeFuyjxYD+i
68P+tIkhBdlwVZfS
inthecryptolane.com
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4304 jrjvptrkw.exe 4032 jrjvptrkw.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation jrjvptrkw.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4304 set thread context of 4032 4304 jrjvptrkw.exe 87 PID 4032 set thread context of 1108 4032 jrjvptrkw.exe 67 PID 3296 set thread context of 1108 3296 wlanext.exe 67 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \Registry\User\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 4032 jrjvptrkw.exe 4032 jrjvptrkw.exe 4032 jrjvptrkw.exe 4032 jrjvptrkw.exe 4032 jrjvptrkw.exe 4032 jrjvptrkw.exe 4032 jrjvptrkw.exe 4032 jrjvptrkw.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1108 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 4304 jrjvptrkw.exe 4032 jrjvptrkw.exe 4032 jrjvptrkw.exe 4032 jrjvptrkw.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe 3296 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 4032 jrjvptrkw.exe Token: SeDebugPrivilege 3296 wlanext.exe Token: SeShutdownPrivilege 1108 Explorer.EXE Token: SeCreatePagefilePrivilege 1108 Explorer.EXE Token: SeShutdownPrivilege 1108 Explorer.EXE Token: SeCreatePagefilePrivilege 1108 Explorer.EXE Token: SeShutdownPrivilege 1108 Explorer.EXE Token: SeCreatePagefilePrivilege 1108 Explorer.EXE Token: SeShutdownPrivilege 1108 Explorer.EXE Token: SeCreatePagefilePrivilege 1108 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4580 wrote to memory of 4304 4580 cd0e4cab67b7fd76ef5d6bdcb7f25a21.exe 86 PID 4580 wrote to memory of 4304 4580 cd0e4cab67b7fd76ef5d6bdcb7f25a21.exe 86 PID 4580 wrote to memory of 4304 4580 cd0e4cab67b7fd76ef5d6bdcb7f25a21.exe 86 PID 4304 wrote to memory of 4032 4304 jrjvptrkw.exe 87 PID 4304 wrote to memory of 4032 4304 jrjvptrkw.exe 87 PID 4304 wrote to memory of 4032 4304 jrjvptrkw.exe 87 PID 4304 wrote to memory of 4032 4304 jrjvptrkw.exe 87 PID 1108 wrote to memory of 3296 1108 Explorer.EXE 88 PID 1108 wrote to memory of 3296 1108 Explorer.EXE 88 PID 1108 wrote to memory of 3296 1108 Explorer.EXE 88 PID 3296 wrote to memory of 3116 3296 wlanext.exe 90 PID 3296 wrote to memory of 3116 3296 wlanext.exe 90 PID 3296 wrote to memory of 3116 3296 wlanext.exe 90
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\cd0e4cab67b7fd76ef5d6bdcb7f25a21.exe"C:\Users\Admin\AppData\Local\Temp\cd0e4cab67b7fd76ef5d6bdcb7f25a21.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe"C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe" C:\Users\Admin\AppData\Local\Temp\aomgdquqwa.bts3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe"C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3116
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD570ac455f88e10ec69807e8d27c5b98a7
SHA157dbd9bc79b94886f79354ca2025232a5d0076fb
SHA256157b2b1dcb46cfbd5f8ebbcc64bae4fdd45fb9f6843549d5efa39ff294156e68
SHA5124e732530fa2d008d57f86a2f62010d04a67764c230e9f966cf30bdbef2064b0dfc05a983d7919af7db03c690584dd8115ea7dd4b3e34f28cd49cf318dc13b8e1
-
Filesize
12KB
MD5fd0ddc905a5457c8fdd921103f410846
SHA120517958c1cba91084f5011cccf3ece8fdc9a237
SHA25607b65ff3ea050e07441aae8967be4843a74797d004f3aa0b700f5faa59caccec
SHA5122c246fdd4852c364c87ee846682da0b05c419d327456f3ba5e8d00e45f7ac185f00507589219671b82bba4af32369100df577962d0e20f839cfeb8197c7c8c49
-
Filesize
12KB
MD5fd0ddc905a5457c8fdd921103f410846
SHA120517958c1cba91084f5011cccf3ece8fdc9a237
SHA25607b65ff3ea050e07441aae8967be4843a74797d004f3aa0b700f5faa59caccec
SHA5122c246fdd4852c364c87ee846682da0b05c419d327456f3ba5e8d00e45f7ac185f00507589219671b82bba4af32369100df577962d0e20f839cfeb8197c7c8c49
-
Filesize
12KB
MD5fd0ddc905a5457c8fdd921103f410846
SHA120517958c1cba91084f5011cccf3ece8fdc9a237
SHA25607b65ff3ea050e07441aae8967be4843a74797d004f3aa0b700f5faa59caccec
SHA5122c246fdd4852c364c87ee846682da0b05c419d327456f3ba5e8d00e45f7ac185f00507589219671b82bba4af32369100df577962d0e20f839cfeb8197c7c8c49
-
Filesize
185KB
MD5e90088efd1be37bc124d82ce812bd327
SHA1633c82a7f3334b6c48a23e96b9ff6116c7cdce27
SHA25609b39f471b88b40e2c29f61d06005b27b799a6d274f0f74262d46d11f9a36d8d
SHA512f93f6119cd5b8c04426b917f6cf6d2f16797970ea4ae00ed0e8014862651ce25a23a5ee60b36aacd37dd7691b3d3bd63c1bdd3a4b0b243456524aff40b7240a4