Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
184s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2022, 01:07
Static task
static1
Behavioral task
behavioral1
Sample
9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
Resource
win10v2004-20221111-en
General
-
Target
9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
-
Size
179KB
-
MD5
79372dcbf9858b005729da221561b2aa
-
SHA1
a499819f0659340a5d9ea72d4aa3c2189908551a
-
SHA256
9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1
-
SHA512
baef407ec4dac0fa792932546bd762c5d9c3e360f281ce4014700115946ff04560c09499e72a1ce4fc28940cd86080ddf8fdb41a4bbc599e00e432a28949855b
-
SSDEEP
3072:ABAp5XhKpN4eOyVTGfhEClj8jTk+0hvXUDFY/2g3xrpr:3bXE9OiTGfhEClq9QUDF2
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 46 2332 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\1\2\sogazr.bat 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe File opened for modification C:\Program Files (x86)\1\2\daet.vbs 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe File opened for modification C:\Program Files (x86)\1\2\ekstaz.vbs 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe File opened for modification C:\Program Files (x86)\1\2\kids.txt 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe File opened for modification C:\Program Files (x86)\1\2\gam.txt 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4128 wrote to memory of 3452 4128 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe 83 PID 4128 wrote to memory of 3452 4128 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe 83 PID 4128 wrote to memory of 3452 4128 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe 83 PID 4128 wrote to memory of 2332 4128 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe 85 PID 4128 wrote to memory of 2332 4128 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe 85 PID 4128 wrote to memory of 2332 4128 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe 85 PID 4128 wrote to memory of 3520 4128 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe 86 PID 4128 wrote to memory of 3520 4128 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe 86 PID 4128 wrote to memory of 3520 4128 9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe"C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\1\2\sogazr.bat" "2⤵
- Drops file in Drivers directory
PID:3452
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\daet.vbs"2⤵
- Blocklisted process makes network request
PID:2332
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\ekstaz.vbs"2⤵
- Drops file in Drivers directory
PID:3520
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547B
MD5232aa0068739f14ea68404c1dcb71929
SHA1c70a0711fd6b9f38260b1c6dcb43e97ca2ad06a7
SHA2568530396ddc8187a992d6561d04cb8a1726acf9ec299452e5395ac3aefce8d95b
SHA51267717519e6df96404468a0a4af3ff7b3af5c136b7715f5955b6ddebc4b7ffae8d1c679d782511843e694336c2e6ec62e1a55af99d64c46adec20f777caca9d23
-
Filesize
588B
MD589031d9b74652f0be426774267586b8d
SHA17fd55000c315bcbd55ff51ed7b0ca201e978a8dc
SHA256b50e00e042f97ad4e848444c9b2281e9dbb03dec367b53fcbe376e54c1e8fd4b
SHA512fa0f2b5d94a14934c5ff100ef90c8a4af8686abeb4b67f02fc15d25f5181ec705b2182e22ed88be8647e5d87e5467db5f6a4d04d71edb55ff167a64e9cd5f40f
-
Filesize
1B
MD5fc1262746424402278e88f6c1f02f581
SHA177ac341feebeb7c0a7ff8f9c6540531500693bac
SHA25694455e3ed9f716bea425ef99b51fae47128769a1a0cd04244221e4e14631ab83
SHA512f9cd8ac2f900da287babe09ec5a017506809531fa60d273a75eb2d5c7d9ad2d7596b4deb3dfd01638295e06a572c306fc0014dd36def8aa6c72de426a9bacff6
-
Filesize
5B
MD58249407cf0da9a987b8d09ce7f4d2979
SHA173c63d88a3fc1f87e6c66e437b458c1826efca8e
SHA256d9caa2357f1ea7b8b1d10caf71f96e52e19b7446f017eea5f197710b650938a2
SHA512f6d066137a051bee999489167da6f31d5a71ef0a127f286f8aebb2a9cc9f2437a06b37e5e5b671bd0344fbec45c79c6b8ddb2b1ab797a9a08bbb017d00fd6d26
-
Filesize
3KB
MD5eadc34423f9258a670719eb7e2897f6a
SHA18a3a364c70fb77148c345a709f62dece838900e0
SHA256033ace201e06b89a6689dd64f61afb047fbdf1bf10d0d96b8a2bc2de9ae77560
SHA512bf2981bab0604962e235dbad6422b7d779bdf63e1578ba2a61f9f894c0a72725e809d6b1d1364642b6d4411c7183711bfad1a6a9efb86e014f5d692d3df20b9e
-
Filesize
1KB
MD543d6665309616ca3f6113e06150a8ea6
SHA17d03ffdfcbd8e2cbc93b570e4458a5805ab3d7f1
SHA256febd4744a28c35d65073acd9b18bccf9946fb8e0b5f3c29238dcebf569e7c656
SHA51271faaca6cb6961ee62e6a76bed8217eb4867a440aad1bf05520d03d7be17dcd3058cdf4b0d38fc8c3a354a54251a31020ce806ebb0af611378c8ac81b5c7d00d