Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
20/04/2023, 11:09
General
-
Target
tmp.exe
-
Size
375KB
-
MD5
8c1fdfac9ebd282be0a85164120445ae
-
SHA1
249647954c4d28aea0f517c6831102430cd9cd3f
-
SHA256
340c89d0d81447bbe9855d625048e84b7226beb0bc9c4cbb7cc54891449d785a
-
SHA512
d18cae71203ca7bf8e2ab85559932a0896a139237f4732fa382aac80f3cedf514d22dd17107173ae3706eb65b1dbe35fa98d4d772dd5a13979993b0624f22a3d
-
SSDEEP
6144:PYa6Blr2Uv5LIYxmevmwwYztxy4yY0n4Av1ZYQ9yra/EpCsMjACt+wPp6g7m1Q/r:PYzlCqY7wjx04sZ1ycV8Q+wPtCC
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe" C:\Users\Admin\AppData\Local\Temp\ovlmifu.st2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD53d2b994d23fbf53a10e5d02b708b901b
SHA1642201f31c3c7adf90208d5b13ef553a3a5c9a46
SHA25629c66e8e087271ac091326936c796454cc0961ab6f5805c9a91cd087894b9a8b
SHA512a2638b327a7742653f2ec8c56359eb8c934f91f687e83118676220ccf83d24f21f60d9256acfbccc9337c22ada47d1ba2ab70806676b8b2b16e1078cbfab77ad
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
323KB
MD5720c9c0fa6c97ff562bd780799354bea
SHA181a64489fe39f0669812506734386a68089b321d
SHA256b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f
SHA512eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5
-
Filesize
5KB
MD51888157b960f14ecc9a310dc35bca5ad
SHA173cfaadd5c99ea41bb8bd27441898a63f7c31251
SHA2560fdeb156d6ec7bbfba51f0167d7ce92b31b2aa862eaac92db52de594ce3460df
SHA512df0035e7f672a2f00c81e3a2e287798b6b979a1f5527faa387418092b75c2a8151a893597453afbf8942b3d656b55d52ad0b415e3e0352c889e32942a6d685bc
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
8KB