Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10samples2.zip
windows7-x64
1samples2.zip
windows10-2004-x64
1032e2e00eb...36.exe
windows7-x64
3032e2e00eb...36.exe
windows10-2004-x64
307e98c92e1...3b.exe
windows7-x64
807e98c92e1...3b.exe
windows10-2004-x64
80a045d39cb...35.exe
windows7-x64
70a045d39cb...35.exe
windows10-2004-x64
72d713e13f7...d3.exe
windows7-x64
12d713e13f7...d3.exe
windows10-2004-x64
137a83fd6b1...32.exe
windows7-x64
137a83fd6b1...32.exe
windows10-2004-x64
1390b31934a...56.exe
windows7-x64
9390b31934a...56.exe
windows10-2004-x64
94dc6bd447e...9d.exe
windows7-x64
14dc6bd447e...9d.exe
windows10-2004-x64
15300d74561...0d.exe
windows7-x64
105300d74561...0d.exe
windows10-2004-x64
105e7d11d6bd...c6.exe
windows7-x64
75e7d11d6bd...c6.exe
windows10-2004-x64
164c7d9f709...20.exe
windows7-x64
164c7d9f709...20.exe
windows10-2004-x64
17db03ff8a8...3a.exe
windows7-x64
17db03ff8a8...3a.exe
windows10-2004-x64
181cb6442c2...78.exe
windows7-x64
181cb6442c2...78.exe
windows10-2004-x64
18629ec2aed...11.exe
windows7-x64
18629ec2aed...11.exe
windows10-2004-x64
18b13ff52ff...ab.exe
windows7-x64
88b13ff52ff...ab.exe
windows10-2004-x64
890b4871229...11.exe
windows7-x64
790b4871229...11.exe
windows10-2004-x64
7Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 15:27
Behavioral task
behavioral1
Sample
samples2.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
samples2.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
032e2e00ebb50fcd0c1b56a4cfb9479683e15de23e336556ea3783038e18b536.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
032e2e00ebb50fcd0c1b56a4cfb9479683e15de23e336556ea3783038e18b536.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
07e98c92e1f9859a16b31df6aa5bc83c0d11d4f5f9d8a8ce5d7ddc1a0655a73b.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
07e98c92e1f9859a16b31df6aa5bc83c0d11d4f5f9d8a8ce5d7ddc1a0655a73b.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
2d713e13f7941f69ff7978a16736aac4019955895a79636eed1738c1f6a3e0d3.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
2d713e13f7941f69ff7978a16736aac4019955895a79636eed1738c1f6a3e0d3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
37a83fd6b1048433907502f8e50aabdcbae822388ea284e81e9ea1b199674732.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
37a83fd6b1048433907502f8e50aabdcbae822388ea284e81e9ea1b199674732.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
390b31934a8c6923fca53127953406a98231e4437a8523f242c072b0c38bb756.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
390b31934a8c6923fca53127953406a98231e4437a8523f242c072b0c38bb756.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
4dc6bd447edc955f853e3d624be982a77e219a0d8d78c9009ecfd0b6bf18049d.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
4dc6bd447edc955f853e3d624be982a77e219a0d8d78c9009ecfd0b6bf18049d.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
5300d7456183c470a40267da9cd1771d6147445b203d8eb02437348bf3169e0d.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
5300d7456183c470a40267da9cd1771d6147445b203d8eb02437348bf3169e0d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
5e7d11d6bd11b09c4cc0c4ba54ebea19dcc06ae585d0508d3d8dba251075f4c6.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
5e7d11d6bd11b09c4cc0c4ba54ebea19dcc06ae585d0508d3d8dba251075f4c6.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
64c7d9f709c2e8f059e695db2b1dd84db7b1061ea0a445046603291749fb0920.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
64c7d9f709c2e8f059e695db2b1dd84db7b1061ea0a445046603291749fb0920.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
7db03ff8a8f7a96bff02870cd5975b06ac52f2816a7c4ee8f2473a301bea133a.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
7db03ff8a8f7a96bff02870cd5975b06ac52f2816a7c4ee8f2473a301bea133a.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
81cb6442c2562274be3b9bc33c6fc5a4c5c43b0569494f857157eef1e9613178.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
81cb6442c2562274be3b9bc33c6fc5a4c5c43b0569494f857157eef1e9613178.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
8629ec2aedcf3d482ced397406a20fc49e64adf5eb52b717fa331730404de411.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
8629ec2aedcf3d482ced397406a20fc49e64adf5eb52b717fa331730404de411.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
8b13ff52ff84eff160a5c0b8c80c7bd336e5bcfef7730ce7a5c499f112632bab.exe
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
8b13ff52ff84eff160a5c0b8c80c7bd336e5bcfef7730ce7a5c499f112632bab.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
90b4871229a8654c4258d4d470475e891b7db88407f53653a110de8d70fa4811.exe
Resource
win7-20231215-en
General
-
Target
0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe
-
Size
225KB
-
MD5
19275ec337c79577d1b218afcc5fdf96
-
SHA1
c6fb78e7203073f9bfceda682c0fede8d5d645f7
-
SHA256
0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35
-
SHA512
faaef2dee406f0ef52a80e413410a45b76903b3702ab14b8be8c946566fa80a87fa5b09bf643e00b75629b0355ba2044fba5d8713a526f0e8a935bd906a7eb7f
-
SSDEEP
6144:zrA1b71kw8TML7RiVhVPuV17rQ+LGsuUSpbO:zr7P8iVmVdQ+LqJE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation Ransom.exe -
Executes dropped EXE 2 IoCs
pid Process 1256 Ransom.exe 3312 RANSED_WATCH.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RANSED = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ransom.exe" Ransom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1256 Ransom.exe 1256 Ransom.exe 1256 Ransom.exe 1256 Ransom.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 1256 Ransom.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe 3312 RANSED_WATCH.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4500 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1256 Ransom.exe Token: SeDebugPrivilege 3312 RANSED_WATCH.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 556 wrote to memory of 1256 556 0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe 93 PID 556 wrote to memory of 1256 556 0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe 93 PID 556 wrote to memory of 1256 556 0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe 93 PID 556 wrote to memory of 4500 556 0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe 92 PID 556 wrote to memory of 4500 556 0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe 92 PID 556 wrote to memory of 4500 556 0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe 92 PID 4500 wrote to memory of 4460 4500 cmd.exe 95 PID 4500 wrote to memory of 4460 4500 cmd.exe 95 PID 4500 wrote to memory of 4460 4500 cmd.exe 95 PID 1256 wrote to memory of 3312 1256 Ransom.exe 106 PID 1256 wrote to memory of 3312 1256 Ransom.exe 106 PID 1256 wrote to memory of 3312 1256 Ransom.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe"C:\Users\Admin\AppData\Local\Temp\0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & MOVE /Y C:\Users\Admin\AppData\Local\Temp\0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe C:\Users\Admin\AppData\Local\Temp\2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 13⤵PID:4460
-
-
-
C:\Users\Admin\AppData\Local\Temp\Ransom.exe"C:\Users\Admin\AppData\Local\Temp\Ransom.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\RANSED_WATCH.exe"C:\Users\Admin\AppData\Local\Temp\RANSED_WATCH.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD54d7bab2c3c2ddc1e72cd31124af8e59c
SHA1ed310764bb3903dfc1b810d16ddac778dbd5a4a5
SHA25644a2f5a450185c2d464417d805691b17c5226b650bdc34964b584ef9efb50509
SHA5128b367639e292a646a720fdccfb1342b3b7336b91dcbfb67933189e3b37c41af440a8ef552873dfc208232d2660857dc0de7a27cfbaef192b484f97bbab7d4325
-
Filesize
134KB
MD5d21d6c0d9f615f6b59be2ff779ea5503
SHA115b6e018c25791fb5980e6331536eb8bc2b7b1bc
SHA2564dc73b89c5e8e39369ec998783078aa26a220bd31946b7618ad867ca5a6f9466
SHA512920a30dd89d3f0af306ddeec79a43d70f5bc56563b2fd129b6e689c3dbfe119aab3722d86f3c98ec891c1a60facf0120c2cb14db8eba8ae39421f21c6a7923b2
-
Filesize
206KB
MD5e6cdc4b7004252b09b5b104bdac8508f
SHA13f197934954585c8d9ab01f147933ca026f5f78a
SHA256dcd67b0f2b4900d25f0ceff8c6680a91044552140423cb903822a0efadc56771
SHA512f1849c01f261eac930fe8c9cb1af1a4ed4a2599a69eb99336d30ee7258d6199f1dfbf41f7bbad22e2675ebd139adc77ee159da729f13bedbebd506c329766603
-
Filesize
131KB
MD556b346a28b1255963a9a154d77e67f56
SHA1a590dbe7114b6594ceeaa842151b009e1ac4cb6f
SHA256a920aea1f92a7844533e782c142d55d262b98db7c76526170daa197e302df783
SHA512b8c21e9f21a621701003d69415dfc59a9bc969ce6b5cd58f7380c450484a1b3dec0083b4d75c04db48ea17785f77581f8e1509e5a095c8f5562c085a680d5741