Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2022, 00:02

General

  • Target

    a9373762aae59bab9ed837cba6b3df80c5d200831f1eb9c79701af4aad723572.exe

  • Size

    1.5MB

  • MD5

    c4d112b122745f2edfd1d2840ade624a

  • SHA1

    8393a23ca04408c150df5cf43b72c950fd75edcb

  • SHA256

    a9373762aae59bab9ed837cba6b3df80c5d200831f1eb9c79701af4aad723572

  • SHA512

    aa64a51421440a2b7cfd9110977e26a8f9cf8f41c8e8e5172f430e110dad0df3260d611216a8bfa215d4e44e20c9d31ba24d347bd668398512d9560470334a2c

  • SSDEEP

    24576:ZBrr/4p6qO4pDlPJsZtZQk5p8hulbEwfDpBzjRvdsxlTShiVPDvE:rv/4Qf4pxPctqG8IllnxvdsxZ4U7M

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9373762aae59bab9ed837cba6b3df80c5d200831f1eb9c79701af4aad723572.exe
    "C:\Users\Admin\AppData\Local\Temp\a9373762aae59bab9ed837cba6b3df80c5d200831f1eb9c79701af4aad723572.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3124
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3124 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2856
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://taourl.com/6jb4v
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3092
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://taourl.com/6jb4v
        3⤵
        • Modifies Internet Explorer settings
        PID:4140
    • C:\Windows\SysWOW64\Wscript.exe
      "C:\Windows\system32\Wscript" "C:\Program Files (x86)\soft251811\b_2511.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\soft251811\300.bat" "
        3⤵
          PID:1616

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\soft251811\300.bat

      Filesize

      3KB

      MD5

      269ca4bcff76c416808ff1e5472e2bbe

      SHA1

      7d9cea09d6d5633ecb89817ac046aec056a30ee1

      SHA256

      53c02fd73eb05e0cd4153fe10db550f9fdd3ab4f0563d7289830efaaeee54de0

      SHA512

      8ec7284889022829f521bc99ddafff641c33129854e9fb4941fe6ec8ad85d1ac2e52e39012ea84f99250c5b493dd04413ae8e152f4bfe06802371d75e89ce84b

    • C:\Program Files (x86)\soft251811\b_2511.vbs

      Filesize

      348B

      MD5

      2a843158e18cff58acbd98aa49574b08

      SHA1

      fdf78e410b1d98a7856a7114add6f1150c69bc48

      SHA256

      c2b28114de4c4967df161de3583671bbdbb0da60724eb79b6794137da987359d

      SHA512

      2cdb0e9829113b65b3b51c71fc9090e5c0c0147c50e5cd5a419d87e1d60de0032f061db21700e550a62660a9dc11695961c46bf637cadea46d817b175d2a518c

    • C:\Users\Admin\AppData\Local\Temp\nsrB3E4.tmp\FindProcDLL.dll

      Filesize

      31KB

      MD5

      83cd62eab980e3d64c131799608c8371

      SHA1

      5b57a6842a154997e31fab573c5754b358f5dd1c

      SHA256

      a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

      SHA512

      91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

    • C:\Users\Admin\AppData\Local\Temp\nsrB3E4.tmp\FindProcDLL.dll

      Filesize

      31KB

      MD5

      83cd62eab980e3d64c131799608c8371

      SHA1

      5b57a6842a154997e31fab573c5754b358f5dd1c

      SHA256

      a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

      SHA512

      91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

    • C:\Users\Admin\AppData\Local\Temp\nsrB3E4.tmp\FindProcDLL.dll

      Filesize

      31KB

      MD5

      83cd62eab980e3d64c131799608c8371

      SHA1

      5b57a6842a154997e31fab573c5754b358f5dd1c

      SHA256

      a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

      SHA512

      91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

    • C:\Users\Admin\AppData\Local\Temp\nsrB3E4.tmp\NSISdl.dll

      Filesize

      14KB

      MD5

      254f13dfd61c5b7d2119eb2550491e1d

      SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

      SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

      SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

    • C:\Users\Admin\AppData\Local\Temp\nsrB3E4.tmp\NSISdl.dll

      Filesize

      14KB

      MD5

      254f13dfd61c5b7d2119eb2550491e1d

      SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

      SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

      SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

    • C:\Users\Admin\AppData\Local\Temp\nsrB3E4.tmp\NSISdl.dll

      Filesize

      14KB

      MD5

      254f13dfd61c5b7d2119eb2550491e1d

      SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

      SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

      SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

    • C:\Users\Admin\AppData\Local\Temp\nsrB3E4.tmp\NSISdl.dll

      Filesize

      14KB

      MD5

      254f13dfd61c5b7d2119eb2550491e1d

      SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

      SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

      SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

    • C:\Users\Admin\AppData\Local\Temp\nsrB3E4.tmp\NSISdl.dll

      Filesize

      14KB

      MD5

      254f13dfd61c5b7d2119eb2550491e1d

      SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

      SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

      SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

    • C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\ Intornot Exploror .lnk

      Filesize

      1KB

      MD5

      03e8712d6166e9c9a258e2384c062752

      SHA1

      eeb824c31ab9c8501db835baf61a914a528bbfb2

      SHA256

      b545cfce9a4640a528c6d29db31ab553212fd46eb9b956d269fd086580628c0a

      SHA512

      5bd6c8ca6a02035461fcad38baef71cd922595997ad6d257f996362774921af2e7438d642826733a82e2f41e52b7628c893716e2bd250ccf03e15758178501e7