Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2023, 18:56
Behavioral task
behavioral1
Sample
decrypted.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
decrypted.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
decrypted.exe
-
Size
36KB
-
MD5
804457c473500f8fe0d57b0864c4c87f
-
SHA1
633c8ff70bc17c12e2727c3e1278349a8b67fe50
-
SHA256
601ac6852746a608f82af16fe69b07a5c65afc584d59479a8fcf43bd0537997f
-
SHA512
f68e765f26d6ff16a4f2a89f367e0cf57278a595f321a362c8b037526106dc319cd6894b4def3d1aa474ce412db0395926e7483d26abca72e196f4eac97247d9
-
SSDEEP
768:C9S2Mfp8Y8JuL8O2qD86BhEOaDUeKR0F6Ehq5lxOBcmZPtqojC:C9S2MfgQQahEOaDUzRb5lxOWmyl
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1756 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation decrypted.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bf4f23b08f31e19e05b45991905c12da.exe wlninit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bf4f23b08f31e19e05b45991905c12da.exe wlninit.exe -
Executes dropped EXE 1 IoCs
pid Process 372 wlninit.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bf4f23b08f31e19e05b45991905c12da = "\"C:\\Users\\Admin\\AppData\\Roaming\\wlninit.exe\" .." wlninit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bf4f23b08f31e19e05b45991905c12da = "\"C:\\Users\\Admin\\AppData\\Roaming\\wlninit.exe\" .." wlninit.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf wlninit.exe File opened for modification C:\autorun.inf wlninit.exe File created D:\autorun.inf wlninit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe 372 wlninit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 372 wlninit.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe Token: 33 372 wlninit.exe Token: SeIncBasePriorityPrivilege 372 wlninit.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 552 wrote to memory of 372 552 decrypted.exe 79 PID 552 wrote to memory of 372 552 decrypted.exe 79 PID 552 wrote to memory of 372 552 decrypted.exe 79 PID 372 wrote to memory of 1756 372 wlninit.exe 80 PID 372 wrote to memory of 1756 372 wlninit.exe 80 PID 372 wrote to memory of 1756 372 wlninit.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\decrypted.exe"C:\Users\Admin\AppData\Local\Temp\decrypted.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Roaming\wlninit.exe"C:\Users\Admin\AppData\Roaming\wlninit.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\wlninit.exe" "wlninit.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1756
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5804457c473500f8fe0d57b0864c4c87f
SHA1633c8ff70bc17c12e2727c3e1278349a8b67fe50
SHA256601ac6852746a608f82af16fe69b07a5c65afc584d59479a8fcf43bd0537997f
SHA512f68e765f26d6ff16a4f2a89f367e0cf57278a595f321a362c8b037526106dc319cd6894b4def3d1aa474ce412db0395926e7483d26abca72e196f4eac97247d9
-
Filesize
36KB
MD5804457c473500f8fe0d57b0864c4c87f
SHA1633c8ff70bc17c12e2727c3e1278349a8b67fe50
SHA256601ac6852746a608f82af16fe69b07a5c65afc584d59479a8fcf43bd0537997f
SHA512f68e765f26d6ff16a4f2a89f367e0cf57278a595f321a362c8b037526106dc319cd6894b4def3d1aa474ce412db0395926e7483d26abca72e196f4eac97247d9