Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2023, 14:38
Behavioral task
behavioral1
Sample
cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe
Resource
win7-20230220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe
-
Size
3.4MB
-
MD5
1dcfb969cf87e2e4cb9bb4a56e750e15
-
SHA1
c0d398d156582131a4dca76bdb85cf6e3342d68c
-
SHA256
cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c
-
SHA512
f6b9bed8db1012566c80dec02471a6af4a052bf62361f0a51432340960b7cc5b776b384458a47aa462b3f6fa1fd507c0d05f1b5d74216402447d9dfa25771b5b
-
SSDEEP
49152:Mvcs1F4p7LFsNqzfQX6mqDHLvtf2YyAqRZEI/1Tag5rTIluaYdfPKrpjJwebZVTL:MPFUz1DHdgBd26TrPsV2gTgikq
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
resource yara_rule behavioral2/memory/1804-133-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-134-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-135-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-136-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-137-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-138-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-139-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-140-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-141-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-145-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-146-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-147-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-148-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-149-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-150-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-151-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-152-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-153-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-154-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-155-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-156-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-157-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-158-0x0000000000BA0000-0x000000000138E000-memory.dmp themida behavioral2/memory/1804-159-0x0000000000BA0000-0x000000000138E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RYMTSF = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\Chrome.exe\"" cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows\CurrentVersion\Run cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
AutoIT Executable 22 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1804-135-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-136-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-137-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-138-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-139-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-140-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-141-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-145-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-146-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-147-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-148-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-149-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-150-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-151-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-152-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-153-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-154-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-155-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-156-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-157-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-158-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe behavioral2/memory/1804-159-0x0000000000BA0000-0x000000000138E000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1804 wrote to memory of 1328 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 86 PID 1804 wrote to memory of 1328 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 86 PID 1804 wrote to memory of 1328 1804 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe"C:\Users\Admin\AppData\Local\Temp\cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\RYMTSF.vbs2⤵PID:1328
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948B
MD557401e5fd7f02d0a5dd8739c55df638e
SHA167edbf6ca8960d1c1f05e0fa33500a711d01b0be
SHA256de367bde6d9ddd5c8b3a66d273e3d7a229b50b01b0297a5336171c25c20a82a5
SHA5128cecf8309184551275880294cd5b1f4739f505e334718fc4601ebf4cda6f79847de23db7112540f563e51bf4644b83362d235b63f7fdc0bb2aef51d8d59c8b08