Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2023, 15:08
Behavioral task
behavioral1
Sample
973c9b348978d3exeexeexeex.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
973c9b348978d3exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
973c9b348978d3exeexeexeex.exe
-
Size
73KB
-
MD5
973c9b348978d30ffd7b0da63e42f7f0
-
SHA1
37d06206810bc904deddaed52c89b76bbfa31757
-
SHA256
87ce48743b86f148319608b77ba98fd9aaa88db801a42e49f3cd58af01b7de42
-
SHA512
b7f972d46162062ea22e541d2cb60bfde69073fb050d2ace6ee3822daaef34de5c5300e6d40bff882bca248462253913180d63cb510cbf0db076ac88ab5a3a7f
-
SSDEEP
1536:e55u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:0MSjOnrmBTMqqDL2/mr3IdE8we0Avu5h
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 973c9b348978d3exeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wotzbpgowoi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\973c9b348978d3exeexeexeex.exe" 973c9b348978d3exeexeexeex.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\A: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\B: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\H: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\I: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\J: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\Q: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\W: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\Z: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\V: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\E: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\M: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\N: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\O: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\P: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\R: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\T: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\G: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\K: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\L: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\S: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\U: 973c9b348978d3exeexeexeex.exe File opened (read-only) \??\Y: 973c9b348978d3exeexeexeex.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 973c9b348978d3exeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 973c9b348978d3exeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 973c9b348978d3exeexeexeex.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1492 973c9b348978d3exeexeexeex.exe 1492 973c9b348978d3exeexeexeex.exe 1492 973c9b348978d3exeexeexeex.exe 1492 973c9b348978d3exeexeexeex.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1400 1492 973c9b348978d3exeexeexeex.exe 87 PID 1492 wrote to memory of 1400 1492 973c9b348978d3exeexeexeex.exe 87 PID 1492 wrote to memory of 1400 1492 973c9b348978d3exeexeexeex.exe 87 PID 1492 wrote to memory of 2720 1492 973c9b348978d3exeexeexeex.exe 89 PID 1492 wrote to memory of 2720 1492 973c9b348978d3exeexeexeex.exe 89 PID 1492 wrote to memory of 2720 1492 973c9b348978d3exeexeexeex.exe 89 PID 1492 wrote to memory of 616 1492 973c9b348978d3exeexeexeex.exe 91 PID 1492 wrote to memory of 616 1492 973c9b348978d3exeexeexeex.exe 91 PID 1492 wrote to memory of 616 1492 973c9b348978d3exeexeexeex.exe 91 PID 1492 wrote to memory of 3988 1492 973c9b348978d3exeexeexeex.exe 96 PID 1492 wrote to memory of 3988 1492 973c9b348978d3exeexeexeex.exe 96 PID 1492 wrote to memory of 3988 1492 973c9b348978d3exeexeexeex.exe 96 PID 1492 wrote to memory of 2328 1492 973c9b348978d3exeexeexeex.exe 98 PID 1492 wrote to memory of 2328 1492 973c9b348978d3exeexeexeex.exe 98 PID 1492 wrote to memory of 2328 1492 973c9b348978d3exeexeexeex.exe 98 PID 1492 wrote to memory of 2188 1492 973c9b348978d3exeexeexeex.exe 100 PID 1492 wrote to memory of 2188 1492 973c9b348978d3exeexeexeex.exe 100 PID 1492 wrote to memory of 2188 1492 973c9b348978d3exeexeexeex.exe 100 PID 1492 wrote to memory of 2512 1492 973c9b348978d3exeexeexeex.exe 102 PID 1492 wrote to memory of 2512 1492 973c9b348978d3exeexeexeex.exe 102 PID 1492 wrote to memory of 2512 1492 973c9b348978d3exeexeexeex.exe 102 PID 1492 wrote to memory of 4996 1492 973c9b348978d3exeexeexeex.exe 104 PID 1492 wrote to memory of 4996 1492 973c9b348978d3exeexeexeex.exe 104 PID 1492 wrote to memory of 4996 1492 973c9b348978d3exeexeexeex.exe 104 PID 1492 wrote to memory of 4628 1492 973c9b348978d3exeexeexeex.exe 106 PID 1492 wrote to memory of 4628 1492 973c9b348978d3exeexeexeex.exe 106 PID 1492 wrote to memory of 4628 1492 973c9b348978d3exeexeexeex.exe 106 PID 1492 wrote to memory of 3420 1492 973c9b348978d3exeexeexeex.exe 108 PID 1492 wrote to memory of 3420 1492 973c9b348978d3exeexeexeex.exe 108 PID 1492 wrote to memory of 3420 1492 973c9b348978d3exeexeexeex.exe 108 PID 1492 wrote to memory of 2836 1492 973c9b348978d3exeexeexeex.exe 110 PID 1492 wrote to memory of 2836 1492 973c9b348978d3exeexeexeex.exe 110 PID 1492 wrote to memory of 2836 1492 973c9b348978d3exeexeexeex.exe 110 PID 1492 wrote to memory of 4032 1492 973c9b348978d3exeexeexeex.exe 112 PID 1492 wrote to memory of 4032 1492 973c9b348978d3exeexeexeex.exe 112 PID 1492 wrote to memory of 4032 1492 973c9b348978d3exeexeexeex.exe 112 PID 1492 wrote to memory of 2032 1492 973c9b348978d3exeexeexeex.exe 114 PID 1492 wrote to memory of 2032 1492 973c9b348978d3exeexeexeex.exe 114 PID 1492 wrote to memory of 2032 1492 973c9b348978d3exeexeexeex.exe 114 PID 1492 wrote to memory of 3360 1492 973c9b348978d3exeexeexeex.exe 116 PID 1492 wrote to memory of 3360 1492 973c9b348978d3exeexeexeex.exe 116 PID 1492 wrote to memory of 3360 1492 973c9b348978d3exeexeexeex.exe 116 PID 1492 wrote to memory of 4020 1492 973c9b348978d3exeexeexeex.exe 118 PID 1492 wrote to memory of 4020 1492 973c9b348978d3exeexeexeex.exe 118 PID 1492 wrote to memory of 4020 1492 973c9b348978d3exeexeexeex.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\973c9b348978d3exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\973c9b348978d3exeexeexeex.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1400
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2720
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:616
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3988
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2328
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2188
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2512
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:4996
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4628
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3420
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2836
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4032
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2032
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:3360
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4020
-