Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe
Resource
win7-20231129-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe
-
Size
400KB
-
MD5
9476b5f481090ea650cfc65e017dc41c
-
SHA1
0fa937125a55c299a48d3e1485fee16646555087
-
SHA256
2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4
-
SHA512
f97c6bf23101bf357d8e4a4ae47421ecfe8f12c821c036e09a4768a8f0dd9e12ba128cf5f10a0f5d4767ac6a3b7f3497f95ffc07d18ac2b9b4a14c9a2c9c9b6d
-
SSDEEP
12288:/4sAED7kDhOztcOTx00ll7Qbnck6i+JQnlopoMaJU:iEXkDQztfe0szc3nCloy7
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (100) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation pugwp-a.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe -
Executes dropped EXE 2 IoCs
pid Process 3140 pugwp-a.exe 2960 pugwp-a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qewr2342 = "C:\\Users\\Admin\\AppData\\Roaming\\pugwp-a.exe" pugwp-a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qewr2342 = "C:\\Users\\Admin\\AppData\\Roaming\\pugwp-a.exe" pugwp-a.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 67 myexternalip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3136 set thread context of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3140 set thread context of 2960 3140 pugwp-a.exe 101 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt pugwp-a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt pugwp-a.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt pugwp-a.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrome.7z pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\History.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt pugwp-a.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt pugwp-a.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt pugwp-a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4580 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe 2960 pugwp-a.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeSecurityPrivilege 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe Token: SeDebugPrivilege 4212 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe Token: SeSecurityPrivilege 3140 pugwp-a.exe Token: SeDebugPrivilege 2960 pugwp-a.exe Token: SeBackupPrivilege 4532 vssvc.exe Token: SeRestorePrivilege 4532 vssvc.exe Token: SeAuditPrivilege 4532 vssvc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 3136 wrote to memory of 4212 3136 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 95 PID 4212 wrote to memory of 3140 4212 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 99 PID 4212 wrote to memory of 3140 4212 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 99 PID 4212 wrote to memory of 3140 4212 2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe 99 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 3140 wrote to memory of 2960 3140 pugwp-a.exe 101 PID 2960 wrote to memory of 4580 2960 pugwp-a.exe 103 PID 2960 wrote to memory of 4580 2960 pugwp-a.exe 103 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System pugwp-a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" pugwp-a.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe"C:\Users\Admin\AppData\Local\Temp\2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe"C:\Users\Admin\AppData\Local\Temp\2159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4exe.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Roaming\pugwp-a.exeC:\Users\Admin\AppData\Roaming\pugwp-a.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Roaming\pugwp-a.exeC:\Users\Admin\AppData\Roaming\pugwp-a.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2960 -
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet5⤵
- Interacts with shadow copies
PID:4580
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\215973~1.EXE3⤵PID:3096
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400KB
MD59476b5f481090ea650cfc65e017dc41c
SHA10fa937125a55c299a48d3e1485fee16646555087
SHA2562159739a68fa270eb94caddbb7f5d132b1175716efab3b3f25f86dc57c4c0db4
SHA512f97c6bf23101bf357d8e4a4ae47421ecfe8f12c821c036e09a4768a8f0dd9e12ba128cf5f10a0f5d4767ac6a3b7f3497f95ffc07d18ac2b9b4a14c9a2c9c9b6d