Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    172s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2022, 03:05 UTC

General

  • Target

    3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe

  • Size

    176KB

  • MD5

    60705b6e4ee220477320bcf4111c1830

  • SHA1

    d6a1c4f31414c55f2171c4d766d600ba96a307fb

  • SHA256

    3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69

  • SHA512

    f81dba47198250c02dfbe93bbf45f062ebd5e69a8e8da878994178232035f5237be640ad44c9e9954e87f5dcb833d6cc4133b3e3c708014ae0e84bd679004844

  • SSDEEP

    3072:yfRNa4/jynvgWK/fObT/bGiSEIGsbv0OpxYTNPybtDKvS3i:ujG3K/fObT/bGiSE5sj3xYTNPybtDKv9

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe
    "C:\Users\Admin\AppData\Local\Temp\3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Users\Admin\mxrar.exe
      "C:\Users\Admin\mxrar.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3228

Network

  • flag-unknown
    DNS
    ns1.player1352.com
    3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.player1352.com
    IN A
    Response
  • flag-unknown
    DNS
    ns1.player1352.net
    3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.player1352.net
    IN A
    Response
    ns1.player1352.net
    IN A
    35.205.61.67
  • flag-unknown
    DNS
    14.110.152.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.110.152.52.in-addr.arpa
    IN PTR
    Response
  • 199.59.243.222:80
    46 B
    40 B
    1
    1
  • 72.21.81.240:80
    322 B
    7
  • 104.80.225.205:443
    322 B
    7
  • 40.126.32.72:443
    260 B
    5
  • 40.126.32.72:443
    260 B
    5
  • 40.126.32.72:443
    260 B
    5
  • 40.126.32.72:443
    260 B
    5
  • 8.8.8.8:53
    ns1.player1352.com
    dns
    3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe
    64 B
    137 B
    1
    1

    DNS Request

    ns1.player1352.com

  • 8.8.8.8:53
    ns1.player1352.net
    dns
    3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe
    64 B
    80 B
    1
    1

    DNS Request

    ns1.player1352.net

    DNS Response

    35.205.61.67

  • 8.8.8.8:53
    14.110.152.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    14.110.152.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\mxrar.exe

    Filesize

    176KB

    MD5

    91f8d86901eec644255f6066217fa429

    SHA1

    88a7291b040e9d72bed80762d223b6000f0c2240

    SHA256

    06bb4b28a1b58732d18d0ed494ba8bfc2ed5082de40ef11c7eae4fd479c054b2

    SHA512

    1461face092b9371da3603914350bb1d7f23ce76a7e18838cada85db6b978b6383a704e635dbb8be64953b679349e5326696e19f329f0495caa6a77997b7c5e6

  • C:\Users\Admin\mxrar.exe

    Filesize

    176KB

    MD5

    91f8d86901eec644255f6066217fa429

    SHA1

    88a7291b040e9d72bed80762d223b6000f0c2240

    SHA256

    06bb4b28a1b58732d18d0ed494ba8bfc2ed5082de40ef11c7eae4fd479c054b2

    SHA512

    1461face092b9371da3603914350bb1d7f23ce76a7e18838cada85db6b978b6383a704e635dbb8be64953b679349e5326696e19f329f0495caa6a77997b7c5e6

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.