Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2023, 01:27
Static task
static1
Behavioral task
behavioral1
Sample
ab2894916ee51487f4a3405783dfb37b2df98920560c11b7814970bff10feea1.exe
Resource
win10v2004-20230220-en
General
-
Target
ab2894916ee51487f4a3405783dfb37b2df98920560c11b7814970bff10feea1.exe
-
Size
1.2MB
-
MD5
bff91d1335ec71ff61694b2abb06a649
-
SHA1
58f140da7046195745e0978d61debee3f139842f
-
SHA256
ab2894916ee51487f4a3405783dfb37b2df98920560c11b7814970bff10feea1
-
SHA512
d191e89e9f4358d1b6609f5eac2fa0e4ba221d5718d0832b3e58d423e9cd1fa07a8c82050a2fb61deea58f40433e579c3b81be185d98dc54b91583dd1f56f651
-
SSDEEP
24576:I/XEXjJSFHUKBjibjqNyj9wowTQ7Z6q8j6kIfEOZdVndDkRO8PcE+m4g9FX:I/oSBajgySiZ6aPZNIIK+m4g9FX
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation ab2894916ee51487f4a3405783dfb37b2df98920560c11b7814970bff10feea1.exe -
Loads dropped DLL 3 IoCs
pid Process 3692 rundll32.exe 220 rundll32.exe 220 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3304 wrote to memory of 1068 3304 ab2894916ee51487f4a3405783dfb37b2df98920560c11b7814970bff10feea1.exe 83 PID 3304 wrote to memory of 1068 3304 ab2894916ee51487f4a3405783dfb37b2df98920560c11b7814970bff10feea1.exe 83 PID 3304 wrote to memory of 1068 3304 ab2894916ee51487f4a3405783dfb37b2df98920560c11b7814970bff10feea1.exe 83 PID 1068 wrote to memory of 3692 1068 control.exe 84 PID 1068 wrote to memory of 3692 1068 control.exe 84 PID 1068 wrote to memory of 3692 1068 control.exe 84 PID 3692 wrote to memory of 3872 3692 rundll32.exe 89 PID 3692 wrote to memory of 3872 3692 rundll32.exe 89 PID 3872 wrote to memory of 220 3872 RunDll32.exe 90 PID 3872 wrote to memory of 220 3872 RunDll32.exe 90 PID 3872 wrote to memory of 220 3872 RunDll32.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab2894916ee51487f4a3405783dfb37b2df98920560c11b7814970bff10feea1.exe"C:\Users\Admin\AppData\Local\Temp\ab2894916ee51487f4a3405783dfb37b2df98920560c11b7814970bff10feea1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" .\4xDTf~.L2⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\4xDTf~.L3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\4xDTf~.L4⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\4xDTf~.L5⤵
- Loads dropped DLL
PID:220
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD59007b384fe5396937d24577ee01b90e1
SHA1e34d05c039853dfa9d6ee67a9acc0149547fe9bf
SHA2560dbfa7ce563ebec5042d19f375e4d4f2bce1a9c43d693fc2b2bc4aef897e40dd
SHA512b77f77fa03eede2c79d3f460381807ba025676664e073f46cff72f9d66e686b33a5028b18c1e10d62f396217b7b1fd62ea3b70a15c475bfc1993ad7648135f06
-
Filesize
1.0MB
MD59007b384fe5396937d24577ee01b90e1
SHA1e34d05c039853dfa9d6ee67a9acc0149547fe9bf
SHA2560dbfa7ce563ebec5042d19f375e4d4f2bce1a9c43d693fc2b2bc4aef897e40dd
SHA512b77f77fa03eede2c79d3f460381807ba025676664e073f46cff72f9d66e686b33a5028b18c1e10d62f396217b7b1fd62ea3b70a15c475bfc1993ad7648135f06
-
Filesize
1.0MB
MD59007b384fe5396937d24577ee01b90e1
SHA1e34d05c039853dfa9d6ee67a9acc0149547fe9bf
SHA2560dbfa7ce563ebec5042d19f375e4d4f2bce1a9c43d693fc2b2bc4aef897e40dd
SHA512b77f77fa03eede2c79d3f460381807ba025676664e073f46cff72f9d66e686b33a5028b18c1e10d62f396217b7b1fd62ea3b70a15c475bfc1993ad7648135f06
-
Filesize
1.0MB
MD59007b384fe5396937d24577ee01b90e1
SHA1e34d05c039853dfa9d6ee67a9acc0149547fe9bf
SHA2560dbfa7ce563ebec5042d19f375e4d4f2bce1a9c43d693fc2b2bc4aef897e40dd
SHA512b77f77fa03eede2c79d3f460381807ba025676664e073f46cff72f9d66e686b33a5028b18c1e10d62f396217b7b1fd62ea3b70a15c475bfc1993ad7648135f06