Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
08/02/2023, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
Protector Del Este S.A.exe
Resource
win10v2004-20221111-en
General
-
Target
Protector Del Este S.A.exe
-
Size
576KB
-
MD5
bf960f17b0877adff061e419d113bde5
-
SHA1
8e7e8814f259fdbc24ae575d84efe899c4bd0fb1
-
SHA256
422bbbe224d6d58280c2fa801357b70528504d318d1f073025b0042ed99e6bbe
-
SHA512
9f01030004f734bdf526c83c00ad58e3500bde52adb187ba99d89908d3660863c9139040270d6615928ded0fe9d2eb4508a62c167864a5843841eb63c3205414
-
SSDEEP
12288:PrD1Ec7ItKCZEQfrCvSTD7r35JpWrNdyOL8aWPXMv5swACzhE+Busk2ai/4CV:PrRtYNFjLlkzwP8vlVE+BY2V4c
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Protector Del Este S.A.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Protector Del Este S.A.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Protector Del Este S.A.exe -
Executes dropped EXE 3 IoCs
pid Process 5088 XClient.exe 3128 XClient.exe 2804 XClient.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 4612 5088 WerFault.exe 82 2784 5096 WerFault.exe 92 3284 1360 WerFault.exe 98 2164 2992 WerFault.exe 100 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5088 XClient.exe Token: SeDebugPrivilege 3128 XClient.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5016 wrote to memory of 5088 5016 Protector Del Este S.A.exe 82 PID 5016 wrote to memory of 5088 5016 Protector Del Este S.A.exe 82 PID 5016 wrote to memory of 2576 5016 Protector Del Este S.A.exe 83 PID 5016 wrote to memory of 2576 5016 Protector Del Este S.A.exe 83 PID 2576 wrote to memory of 3128 2576 Protector Del Este S.A.exe 84 PID 2576 wrote to memory of 3128 2576 Protector Del Este S.A.exe 84 PID 2576 wrote to memory of 880 2576 Protector Del Este S.A.exe 85 PID 2576 wrote to memory of 880 2576 Protector Del Este S.A.exe 85 PID 880 wrote to memory of 2804 880 Protector Del Este S.A.exe 86 PID 880 wrote to memory of 2804 880 Protector Del Este S.A.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5088 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5088 -s 16763⤵
- Program crash
PID:4612
-
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"4⤵
- Executes dropped EXE
PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"4⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"5⤵PID:396
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"5⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"6⤵PID:5096
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5096 -s 16447⤵
- Program crash
PID:2784
-
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"6⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"7⤵PID:4660
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"7⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"8⤵PID:1360
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1360 -s 16449⤵
- Program crash
PID:3284
-
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"8⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"9⤵PID:2992
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2992 -s 164810⤵
- Program crash
PID:2164
-
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"9⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"10⤵PID:4748
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"10⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"11⤵PID:2092
-
-
C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"C:\Users\Admin\AppData\Local\Temp\Protector Del Este S.A.exe"11⤵PID:4072
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 5088 -ip 50881⤵PID:1428
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 528 -p 5096 -ip 50961⤵PID:4200
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 468 -p 1360 -ip 13601⤵PID:4272
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 484 -p 2992 -ip 29921⤵PID:2680
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c
-
Filesize
77KB
MD51b01771066056270e236a7a415e4d5d6
SHA1e551c176070d5a97dd14288d9facdbd988ad3b5f
SHA256240afaf97f02ecf9adafe7c2e2efd9b4a7a3e4652faaa629bb52ad3bc1553193
SHA51263fc3c056fa3aa6d3f232f3eecd4cea4ae8490c7b0d2e8e9e51cc94eda09c64719d71ffc3df16d43ce919392c11e4607cde56cf098edbc73c6ba6e4610537e4c