Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
22/03/2023, 12:07
230322-pafjmagf74 722/03/2023, 12:05
230322-n9pe5sgf67 722/03/2023, 10:15
230322-maftaagc26 7Analysis
-
max time kernel
148s -
max time network
73s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
22/03/2023, 12:05
Behavioral task
behavioral1
Sample
7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20230220-en
General
-
Target
7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe
-
Size
7.8MB
-
MD5
89f7111c4e38e1b15d34cd9c294e410f
-
SHA1
af2afcafd84f6f6fae558975a8b9a86eb8736bce
-
SHA256
7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006
-
SHA512
2285893d4a5f3e020d77c68b86a10cf071b63a3bda826290613939285f045f403e545b8c026d254095e40d3cfe0acaf1c98d84d4817b1fb8b1b4f7ad41fee367
-
SSDEEP
98304:7Tk8J2RM4/x0lBKz3DM2k0JNl/6hLIhlPcArUNpHHKtXfvZv2LMnL5wGwCtT/PCB:U8GM493FZ+LGrUy0IL/B
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2612 DesktopDocuments-tupe6.1.3.4.exe -
resource yara_rule behavioral2/memory/5040-119-0x00007FF7EAB70000-0x00007FF7EB5F7000-memory.dmp upx behavioral2/memory/5040-120-0x00007FF7EAB70000-0x00007FF7EB5F7000-memory.dmp upx behavioral2/memory/5040-122-0x00007FF7EAB70000-0x00007FF7EB5F7000-memory.dmp upx behavioral2/memory/5040-125-0x00007FF7EAB70000-0x00007FF7EB5F7000-memory.dmp upx behavioral2/files/0x000900000001ae90-127.dat upx behavioral2/memory/5040-128-0x00007FF7EAB70000-0x00007FF7EB5F7000-memory.dmp upx behavioral2/memory/2612-130-0x00007FF6EDE30000-0x00007FF6EE8B7000-memory.dmp upx behavioral2/memory/2612-129-0x00007FF6EDE30000-0x00007FF6EE8B7000-memory.dmp upx behavioral2/memory/2612-131-0x00007FF6EDE30000-0x00007FF6EE8B7000-memory.dmp upx behavioral2/memory/2612-132-0x00007FF6EDE30000-0x00007FF6EE8B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\DesktopDocuments-tupe6.1.3.4 = "C:\\ProgramData\\DesktopDocuments-tupe6.1.3.4\\DesktopDocuments-tupe6.1.3.4.exe" 7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5040 wrote to memory of 2612 5040 7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe 66 PID 5040 wrote to memory of 2612 5040 7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe"C:\Users\Admin\AppData\Local\Temp\7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\ProgramData\DesktopDocuments-tupe6.1.3.4\DesktopDocuments-tupe6.1.3.4.exe"C:\ProgramData\DesktopDocuments-tupe6.1.3.4\DesktopDocuments-tupe6.1.3.4.exe"2⤵
- Executes dropped EXE
PID:2612
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
786.5MB
MD539dbcdbf5c0d445524d756c94b902ae1
SHA17c457753ebed0f59685ecb310ed77e129e065bd2
SHA2569fb6c5599a18fd7084b243d690e4e2da489736144bd4d5e8b5a6cfa0e169f3f9
SHA51234b83a574eeaa144d0e1559645cc5f215b8cbcf0e22fe8d3fa46c386e1678d25b3eb62cec1e2d2c049d0fdd26cf86377ef399034e4c370ddb3aad08bcfb1a641