Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2023, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd.exe
Resource
win10v2004-20230220-en
General
-
Target
f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd.exe
-
Size
1.3MB
-
MD5
68ea1aee55be7782878f81072d1cd1e3
-
SHA1
08514104bf3f80f3a3e76000f4cb27f1bb7bb99a
-
SHA256
f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd
-
SHA512
3f392a809e8dfd4dc39fc78bd4d87bbfb4d8a5c5e241badb8e8aacb9a9dc82c9ebae198a82d8f0a0d542fe1fa54e146d55ec0614d81f0e0e491eca438670a9ec
-
SSDEEP
24576:gJr8tE+gHqLmZOdhJstcebAwkFJEOyVgDD0yA8D1wWgTqSTqf:gJ4NL7Jstc1CmDH2FuSe
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd.exe -
Loads dropped DLL 4 IoCs
pid Process 4772 rundll32.exe 4772 rundll32.exe 2152 rundll32.exe 2152 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3360 2928 f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd.exe 88 PID 2928 wrote to memory of 3360 2928 f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd.exe 88 PID 2928 wrote to memory of 3360 2928 f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd.exe 88 PID 3360 wrote to memory of 4772 3360 control.exe 90 PID 3360 wrote to memory of 4772 3360 control.exe 90 PID 3360 wrote to memory of 4772 3360 control.exe 90 PID 4772 wrote to memory of 3992 4772 rundll32.exe 93 PID 4772 wrote to memory of 3992 4772 rundll32.exe 93 PID 3992 wrote to memory of 2152 3992 RunDll32.exe 94 PID 3992 wrote to memory of 2152 3992 RunDll32.exe 94 PID 3992 wrote to memory of 2152 3992 RunDll32.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd.exe"C:\Users\Admin\AppData\Local\Temp\f002b8c38d96b9aad9d7a9e693da95cf90f085313a38619134c964d0ed600cfd.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\XAUI.cpl",2⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\XAUI.cpl",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\XAUI.cpl",4⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\XAUI.cpl",5⤵
- Loads dropped DLL
PID:2152
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5af490b55d846dd6641b9b32139a862db
SHA1d2deff112dee544725c0f93936241629eb707dae
SHA2567c229b26b3547537de79583da23a5ebf3c4118aa52ecc8d8de0785310ce95235
SHA512bdee2927f4d89e68f4b5f7bcb675f8ab12f494cf6b18c973b5a8fbb2674d6e61180b6fac929c31258366afb3659abfc42c9c036a794c74e78c255c4afda21108
-
Filesize
1.0MB
MD5af490b55d846dd6641b9b32139a862db
SHA1d2deff112dee544725c0f93936241629eb707dae
SHA2567c229b26b3547537de79583da23a5ebf3c4118aa52ecc8d8de0785310ce95235
SHA512bdee2927f4d89e68f4b5f7bcb675f8ab12f494cf6b18c973b5a8fbb2674d6e61180b6fac929c31258366afb3659abfc42c9c036a794c74e78c255c4afda21108
-
Filesize
1.0MB
MD5af490b55d846dd6641b9b32139a862db
SHA1d2deff112dee544725c0f93936241629eb707dae
SHA2567c229b26b3547537de79583da23a5ebf3c4118aa52ecc8d8de0785310ce95235
SHA512bdee2927f4d89e68f4b5f7bcb675f8ab12f494cf6b18c973b5a8fbb2674d6e61180b6fac929c31258366afb3659abfc42c9c036a794c74e78c255c4afda21108
-
Filesize
1.0MB
MD5af490b55d846dd6641b9b32139a862db
SHA1d2deff112dee544725c0f93936241629eb707dae
SHA2567c229b26b3547537de79583da23a5ebf3c4118aa52ecc8d8de0785310ce95235
SHA512bdee2927f4d89e68f4b5f7bcb675f8ab12f494cf6b18c973b5a8fbb2674d6e61180b6fac929c31258366afb3659abfc42c9c036a794c74e78c255c4afda21108
-
Filesize
1.0MB
MD5af490b55d846dd6641b9b32139a862db
SHA1d2deff112dee544725c0f93936241629eb707dae
SHA2567c229b26b3547537de79583da23a5ebf3c4118aa52ecc8d8de0785310ce95235
SHA512bdee2927f4d89e68f4b5f7bcb675f8ab12f494cf6b18c973b5a8fbb2674d6e61180b6fac929c31258366afb3659abfc42c9c036a794c74e78c255c4afda21108
-
Filesize
1.0MB
MD5af490b55d846dd6641b9b32139a862db
SHA1d2deff112dee544725c0f93936241629eb707dae
SHA2567c229b26b3547537de79583da23a5ebf3c4118aa52ecc8d8de0785310ce95235
SHA512bdee2927f4d89e68f4b5f7bcb675f8ab12f494cf6b18c973b5a8fbb2674d6e61180b6fac929c31258366afb3659abfc42c9c036a794c74e78c255c4afda21108