Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2022, 18:44

General

  • Target

    b725707ffe49608f7e213e407f6c7c2c5bd9d5bf5ef258d25a0c34462f8c88b9.exe

  • Size

    1.4MB

  • MD5

    6d31f5e15aa86b05399c431a36cb5e81

  • SHA1

    e25bee0fe68dfb01ee5c9b0736095f8dcf2c48d2

  • SHA256

    b725707ffe49608f7e213e407f6c7c2c5bd9d5bf5ef258d25a0c34462f8c88b9

  • SHA512

    86a421d1326717a45c90c666d2f6ead82fd16393eb40fce4bc88540bdb2b6d964c562ed125832d291b0157bc79556ec329f7e25abe1024b2651ee50d7a1032cb

  • SSDEEP

    24576:/GPmdY5IcNSaaaVfVxqo+MuWmQuAQRqUOgqRrN+tvNveCzDugwb:TSafCQRFq50vNeb

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b725707ffe49608f7e213e407f6c7c2c5bd9d5bf5ef258d25a0c34462f8c88b9.exe
    "C:\Users\Admin\AppData\Local\Temp\b725707ffe49608f7e213e407f6c7c2c5bd9d5bf5ef258d25a0c34462f8c88b9.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c rd C:\Windows\system32\drivers\etc\Hosts.dll/s/q
      2⤵
        PID:4948
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c rd C:\Windows\system32\drivers\etc\Hosts/s/q
        2⤵
          PID:2948
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c rd .\Data\PY.dat/s/q
          2⤵
            PID:3276
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c rd .\Data\PercenarySystem.dll/s/q
            2⤵
              PID:1156
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c rd .\Data\TjBin.dll/s/q
              2⤵
                PID:792
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c rd .\Group.dat/s/q
                2⤵
                  PID:3096
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c rd .\Group.dat/s/q
                  2⤵
                    PID:4592
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c rd .\Data\popup.dat/s/q
                    2⤵
                      PID:1152
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c rd .\Data\Game.ini/s/q
                      2⤵
                        PID:1460

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads