Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    184s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2022, 01:07

General

  • Target

    9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe

  • Size

    179KB

  • MD5

    79372dcbf9858b005729da221561b2aa

  • SHA1

    a499819f0659340a5d9ea72d4aa3c2189908551a

  • SHA256

    9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1

  • SHA512

    baef407ec4dac0fa792932546bd762c5d9c3e360f281ce4014700115946ff04560c09499e72a1ce4fc28940cd86080ddf8fdb41a4bbc599e00e432a28949855b

  • SSDEEP

    3072:ABAp5XhKpN4eOyVTGfhEClj8jTk+0hvXUDFY/2g3xrpr:3bXE9OiTGfhEClq9QUDF2

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
    "C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\1\2\sogazr.bat" "
      2⤵
      • Drops file in Drivers directory
      PID:3452
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\daet.vbs"
      2⤵
      • Blocklisted process makes network request
      PID:2332
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\ekstaz.vbs"
      2⤵
      • Drops file in Drivers directory
      PID:3520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\1\2\daet.vbs

    Filesize

    547B

    MD5

    232aa0068739f14ea68404c1dcb71929

    SHA1

    c70a0711fd6b9f38260b1c6dcb43e97ca2ad06a7

    SHA256

    8530396ddc8187a992d6561d04cb8a1726acf9ec299452e5395ac3aefce8d95b

    SHA512

    67717519e6df96404468a0a4af3ff7b3af5c136b7715f5955b6ddebc4b7ffae8d1c679d782511843e694336c2e6ec62e1a55af99d64c46adec20f777caca9d23

  • C:\Program Files (x86)\1\2\ekstaz.vbs

    Filesize

    588B

    MD5

    89031d9b74652f0be426774267586b8d

    SHA1

    7fd55000c315bcbd55ff51ed7b0ca201e978a8dc

    SHA256

    b50e00e042f97ad4e848444c9b2281e9dbb03dec367b53fcbe376e54c1e8fd4b

    SHA512

    fa0f2b5d94a14934c5ff100ef90c8a4af8686abeb4b67f02fc15d25f5181ec705b2182e22ed88be8647e5d87e5467db5f6a4d04d71edb55ff167a64e9cd5f40f

  • C:\Program Files (x86)\1\2\gam.txt

    Filesize

    1B

    MD5

    fc1262746424402278e88f6c1f02f581

    SHA1

    77ac341feebeb7c0a7ff8f9c6540531500693bac

    SHA256

    94455e3ed9f716bea425ef99b51fae47128769a1a0cd04244221e4e14631ab83

    SHA512

    f9cd8ac2f900da287babe09ec5a017506809531fa60d273a75eb2d5c7d9ad2d7596b4deb3dfd01638295e06a572c306fc0014dd36def8aa6c72de426a9bacff6

  • C:\Program Files (x86)\1\2\kids.txt

    Filesize

    5B

    MD5

    8249407cf0da9a987b8d09ce7f4d2979

    SHA1

    73c63d88a3fc1f87e6c66e437b458c1826efca8e

    SHA256

    d9caa2357f1ea7b8b1d10caf71f96e52e19b7446f017eea5f197710b650938a2

    SHA512

    f6d066137a051bee999489167da6f31d5a71ef0a127f286f8aebb2a9cc9f2437a06b37e5e5b671bd0344fbec45c79c6b8ddb2b1ab797a9a08bbb017d00fd6d26

  • C:\Program Files (x86)\1\2\sogazr.bat

    Filesize

    3KB

    MD5

    eadc34423f9258a670719eb7e2897f6a

    SHA1

    8a3a364c70fb77148c345a709f62dece838900e0

    SHA256

    033ace201e06b89a6689dd64f61afb047fbdf1bf10d0d96b8a2bc2de9ae77560

    SHA512

    bf2981bab0604962e235dbad6422b7d779bdf63e1578ba2a61f9f894c0a72725e809d6b1d1364642b6d4411c7183711bfad1a6a9efb86e014f5d692d3df20b9e

  • C:\Windows\System32\drivers\etc\hosts

    Filesize

    1KB

    MD5

    43d6665309616ca3f6113e06150a8ea6

    SHA1

    7d03ffdfcbd8e2cbc93b570e4458a5805ab3d7f1

    SHA256

    febd4744a28c35d65073acd9b18bccf9946fb8e0b5f3c29238dcebf569e7c656

    SHA512

    71faaca6cb6961ee62e6a76bed8217eb4867a440aad1bf05520d03d7be17dcd3058cdf4b0d38fc8c3a354a54251a31020ce806ebb0af611378c8ac81b5c7d00d