Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2023, 02:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe4333d113f866f464884bb210088104.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fe4333d113f866f464884bb210088104.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
fe4333d113f866f464884bb210088104.exe
-
Size
68KB
-
MD5
fe4333d113f866f464884bb210088104
-
SHA1
416f83c1d0aa26809eebfe5446ab79db5d977cf6
-
SHA256
138bae1f48b4b21ca9959fdcf46a4776b68af3590aa2c9ff2b7d7650c5a97a76
-
SHA512
631fe174d79b4d3620748274d18615d6f0b049ad4e6002a7da4301473516f441ee549aaf3aaf9fe53fd4df68c78763826e7ba95cefcf233b8549728c12495ffc
-
SSDEEP
1536:kMozyQo9+pwSgFf076fU6OcossWjcdDvE+VOaF2c:k8axw5sdzDM8pf
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\EditAdd.tiff fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Pictures\RedoSelect.tiff fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Pictures\RequestPing.tiff fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Pictures\WriteComplete.tiff fe4333d113f866f464884bb210088104.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini fe4333d113f866f464884bb210088104.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run fe4333d113f866f464884bb210088104.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zero = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Zero.exe" fe4333d113f866f464884bb210088104.exe -
Drops desktop.ini file(s) 37 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Documents\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Searches\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Videos\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Links\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Music\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini fe4333d113f866f464884bb210088104.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini fe4333d113f866f464884bb210088104.exe