Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/02/2023, 00:45
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 5 IoCs
pid Process 2928 voiceadequovl.exe 4032 voiceadequovl.exe 4508 voiceadequovl.exe 4380 voiceadequovl.exe 3952 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4032 set thread context of 3952 4032 voiceadequovl.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5056 powershell.exe 5056 powershell.exe 3500 powershell.exe 4032 voiceadequovl.exe 4032 voiceadequovl.exe 4032 voiceadequovl.exe 4032 voiceadequovl.exe 3500 powershell.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 4032 voiceadequovl.exe Token: SeDebugPrivilege 5056 powershell.exe Token: SeDebugPrivilege 3500 powershell.exe Token: SeIncreaseQuotaPrivilege 3488 wmic.exe Token: SeSecurityPrivilege 3488 wmic.exe Token: SeTakeOwnershipPrivilege 3488 wmic.exe Token: SeLoadDriverPrivilege 3488 wmic.exe Token: SeSystemProfilePrivilege 3488 wmic.exe Token: SeSystemtimePrivilege 3488 wmic.exe Token: SeProfSingleProcessPrivilege 3488 wmic.exe Token: SeIncBasePriorityPrivilege 3488 wmic.exe Token: SeCreatePagefilePrivilege 3488 wmic.exe Token: SeBackupPrivilege 3488 wmic.exe Token: SeRestorePrivilege 3488 wmic.exe Token: SeShutdownPrivilege 3488 wmic.exe Token: SeDebugPrivilege 3488 wmic.exe Token: SeSystemEnvironmentPrivilege 3488 wmic.exe Token: SeRemoteShutdownPrivilege 3488 wmic.exe Token: SeUndockPrivilege 3488 wmic.exe Token: SeManageVolumePrivilege 3488 wmic.exe Token: 33 3488 wmic.exe Token: 34 3488 wmic.exe Token: 35 3488 wmic.exe Token: 36 3488 wmic.exe Token: SeIncreaseQuotaPrivilege 3488 wmic.exe Token: SeSecurityPrivilege 3488 wmic.exe Token: SeTakeOwnershipPrivilege 3488 wmic.exe Token: SeLoadDriverPrivilege 3488 wmic.exe Token: SeSystemProfilePrivilege 3488 wmic.exe Token: SeSystemtimePrivilege 3488 wmic.exe Token: SeProfSingleProcessPrivilege 3488 wmic.exe Token: SeIncBasePriorityPrivilege 3488 wmic.exe Token: SeCreatePagefilePrivilege 3488 wmic.exe Token: SeBackupPrivilege 3488 wmic.exe Token: SeRestorePrivilege 3488 wmic.exe Token: SeShutdownPrivilege 3488 wmic.exe Token: SeDebugPrivilege 3488 wmic.exe Token: SeSystemEnvironmentPrivilege 3488 wmic.exe Token: SeRemoteShutdownPrivilege 3488 wmic.exe Token: SeUndockPrivilege 3488 wmic.exe Token: SeManageVolumePrivilege 3488 wmic.exe Token: 33 3488 wmic.exe Token: 34 3488 wmic.exe Token: 35 3488 wmic.exe Token: 36 3488 wmic.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 724 wrote to memory of 2928 724 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 79 PID 724 wrote to memory of 2928 724 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 79 PID 724 wrote to memory of 2928 724 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 79 PID 2928 wrote to memory of 4032 2928 voiceadequovl.exe 85 PID 2928 wrote to memory of 4032 2928 voiceadequovl.exe 85 PID 2928 wrote to memory of 4032 2928 voiceadequovl.exe 85 PID 4032 wrote to memory of 5056 4032 voiceadequovl.exe 89 PID 4032 wrote to memory of 5056 4032 voiceadequovl.exe 89 PID 4032 wrote to memory of 5056 4032 voiceadequovl.exe 89 PID 4032 wrote to memory of 3824 4032 voiceadequovl.exe 91 PID 4032 wrote to memory of 3824 4032 voiceadequovl.exe 91 PID 4032 wrote to memory of 3824 4032 voiceadequovl.exe 91 PID 3824 wrote to memory of 3500 3824 cmd.exe 93 PID 3824 wrote to memory of 3500 3824 cmd.exe 93 PID 3824 wrote to memory of 3500 3824 cmd.exe 93 PID 4032 wrote to memory of 4508 4032 voiceadequovl.exe 94 PID 4032 wrote to memory of 4508 4032 voiceadequovl.exe 94 PID 4032 wrote to memory of 4508 4032 voiceadequovl.exe 94 PID 4032 wrote to memory of 4380 4032 voiceadequovl.exe 95 PID 4032 wrote to memory of 4380 4032 voiceadequovl.exe 95 PID 4032 wrote to memory of 4380 4032 voiceadequovl.exe 95 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 4032 wrote to memory of 3952 4032 voiceadequovl.exe 96 PID 3952 wrote to memory of 3488 3952 voiceadequovl.exe 97 PID 3952 wrote to memory of 3488 3952 voiceadequovl.exe 97 PID 3952 wrote to memory of 3488 3952 voiceadequovl.exe 97 PID 3952 wrote to memory of 4252 3952 voiceadequovl.exe 99 PID 3952 wrote to memory of 4252 3952 voiceadequovl.exe 99 PID 3952 wrote to memory of 4252 3952 voiceadequovl.exe 99 PID 4252 wrote to memory of 4692 4252 cmd.exe 101 PID 4252 wrote to memory of 4692 4252 cmd.exe 101 PID 4252 wrote to memory of 4692 4252 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
PID:4508
-
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
PID:4380
-
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵PID:4692
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵PID:856
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵PID:2208
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
Filesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
Filesize
16KB
MD51a87c2ed2a7205592e6acbfd5b843506
SHA1000bb63bb0848ec5676e615e3dbb702029fcff56
SHA256aa97b88cf796c3becbedc68d0459e7c39d1a2e6e1d0353a96c9ab456ea39066a
SHA51228c8ed9754023142b14ad0d361794ca243a010e9f20df8fbd72a810287fcdd80107eeccc379609c7e58cdee6725ffd238ca07ce2b86b53608cec08da51244992
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
Filesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
Filesize
288.1MB
MD57c713d594985fa8d672c38c2a75422e0
SHA1a74b60ccdd8f25659175d3bb5b996b7e416c1b86
SHA25671832972f9c92e2b9d780496cd869634866a8fb0663a0a0f1844bfc56e9176ba
SHA5129b91d267475d1f14f9954a53bb07af42e37b7014dee60ffb0b78f643d580d785184ee09ef56ba814a59be91870ce54cb231a0bc22f04d289bc5650927b64fdaa
-
Filesize
286.4MB
MD5d598dc35e8068aeb481f90055e52b5ae
SHA1ed95ab276be133d238422f3af9051ce9ffa00808
SHA25632974d8d0342bb1b6cfc1f61979e2e1ff747d01da94b3007864c51c29a07237b
SHA512c3276f8c36d04110856bf93f73f88a1206a3047837a35322623082a82c977066de87f48cc8d759640d47df233bed0ce5de193e397020db63e260630a2c750f8a
-
Filesize
317.5MB
MD51dcf226f969ae1a84d9cb496d1efe2b5
SHA16f636fb93435f0ff904a3ad873825baf7c8bff93
SHA256ee9a6ba9de04a1c137680676a18e910c35e3b803cbdc467364c2867aa952af49
SHA5127253eecd3905e0cbbaa45373823ea34fa317a5dda156eab7456836654a3e24fb3af21e8fd1a19d5787613b215c1f6d245b092f35989c05c61a6e1d2de8766aa1