Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2024, 15:27

General

  • Target

    0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe

  • Size

    225KB

  • MD5

    19275ec337c79577d1b218afcc5fdf96

  • SHA1

    c6fb78e7203073f9bfceda682c0fede8d5d645f7

  • SHA256

    0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35

  • SHA512

    faaef2dee406f0ef52a80e413410a45b76903b3702ab14b8be8c946566fa80a87fa5b09bf643e00b75629b0355ba2044fba5d8713a526f0e8a935bd906a7eb7f

  • SSDEEP

    6144:zrA1b71kw8TML7RiVhVPuV17rQ+LGsuUSpbO:zr7P8iVmVdQ+LqJE

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe
    "C:\Users\Admin\AppData\Local\Temp\0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & MOVE /Y C:\Users\Admin\AppData\Local\Temp\0a045d39cbae62c5e73639b6a5a6bdc7948e13d5e960978d22b687d95e599b35.exe C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\SysWOW64\choice.exe
        choice /C Y /N /D Y /T 1
        3⤵
          PID:4460
      • C:\Users\Admin\AppData\Local\Temp\Ransom.exe
        "C:\Users\Admin\AppData\Local\Temp\Ransom.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1256
        • C:\Users\Admin\AppData\Local\Temp\RANSED_WATCH.exe
          "C:\Users\Admin\AppData\Local\Temp\RANSED_WATCH.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3312

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RANSED_WATCH.exe

      Filesize

      6KB

      MD5

      4d7bab2c3c2ddc1e72cd31124af8e59c

      SHA1

      ed310764bb3903dfc1b810d16ddac778dbd5a4a5

      SHA256

      44a2f5a450185c2d464417d805691b17c5226b650bdc34964b584ef9efb50509

      SHA512

      8b367639e292a646a720fdccfb1342b3b7336b91dcbfb67933189e3b37c41af440a8ef552873dfc208232d2660857dc0de7a27cfbaef192b484f97bbab7d4325

    • C:\Users\Admin\AppData\Local\Temp\Ransom.exe

      Filesize

      134KB

      MD5

      d21d6c0d9f615f6b59be2ff779ea5503

      SHA1

      15b6e018c25791fb5980e6331536eb8bc2b7b1bc

      SHA256

      4dc73b89c5e8e39369ec998783078aa26a220bd31946b7618ad867ca5a6f9466

      SHA512

      920a30dd89d3f0af306ddeec79a43d70f5bc56563b2fd129b6e689c3dbfe119aab3722d86f3c98ec891c1a60facf0120c2cb14db8eba8ae39421f21c6a7923b2

    • C:\Users\Admin\AppData\Local\Temp\Ransom.exe

      Filesize

      206KB

      MD5

      e6cdc4b7004252b09b5b104bdac8508f

      SHA1

      3f197934954585c8d9ab01f147933ca026f5f78a

      SHA256

      dcd67b0f2b4900d25f0ceff8c6680a91044552140423cb903822a0efadc56771

      SHA512

      f1849c01f261eac930fe8c9cb1af1a4ed4a2599a69eb99336d30ee7258d6199f1dfbf41f7bbad22e2675ebd139adc77ee159da729f13bedbebd506c329766603

    • C:\Users\Admin\AppData\Local\Temp\Ransom.exe

      Filesize

      131KB

      MD5

      56b346a28b1255963a9a154d77e67f56

      SHA1

      a590dbe7114b6594ceeaa842151b009e1ac4cb6f

      SHA256

      a920aea1f92a7844533e782c142d55d262b98db7c76526170daa197e302df783

      SHA512

      b8c21e9f21a621701003d69415dfc59a9bc969ce6b5cd58f7380c450484a1b3dec0083b4d75c04db48ea17785f77581f8e1509e5a095c8f5562c085a680d5741

    • memory/556-22-0x0000000074E80000-0x0000000075630000-memory.dmp

      Filesize

      7.7MB

    • memory/556-1-0x0000000000E90000-0x0000000000ECE000-memory.dmp

      Filesize

      248KB

    • memory/556-4-0x0000000005830000-0x0000000005840000-memory.dmp

      Filesize

      64KB

    • memory/556-3-0x00000000058A0000-0x0000000005932000-memory.dmp

      Filesize

      584KB

    • memory/556-2-0x0000000005F70000-0x0000000006514000-memory.dmp

      Filesize

      5.6MB

    • memory/556-0-0x0000000074E80000-0x0000000075630000-memory.dmp

      Filesize

      7.7MB

    • memory/556-5-0x0000000005970000-0x000000000597A000-memory.dmp

      Filesize

      40KB

    • memory/1256-25-0x0000000007AE0000-0x0000000007B2C000-memory.dmp

      Filesize

      304KB

    • memory/1256-28-0x0000000074E80000-0x0000000075630000-memory.dmp

      Filesize

      7.7MB

    • memory/1256-23-0x00000000076C0000-0x000000000772E000-memory.dmp

      Filesize

      440KB

    • memory/1256-24-0x0000000007730000-0x0000000007A84000-memory.dmp

      Filesize

      3.3MB

    • memory/1256-19-0x0000000074E80000-0x0000000075630000-memory.dmp

      Filesize

      7.7MB

    • memory/1256-27-0x0000000007B70000-0x0000000007B91000-memory.dmp

      Filesize

      132KB

    • memory/1256-26-0x0000000007BA0000-0x0000000007BDC000-memory.dmp

      Filesize

      240KB

    • memory/1256-20-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/1256-29-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/1256-30-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/1256-18-0x00000000002B0000-0x00000000002EC000-memory.dmp

      Filesize

      240KB

    • memory/3312-129-0x0000000000C20000-0x0000000000C28000-memory.dmp

      Filesize

      32KB

    • memory/3312-130-0x0000000074E80000-0x0000000075630000-memory.dmp

      Filesize

      7.7MB

    • memory/3312-131-0x0000000074E80000-0x0000000075630000-memory.dmp

      Filesize

      7.7MB