Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 00:38
Behavioral task
behavioral1
Sample
a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe
-
Size
321KB
-
MD5
7c96150f051a1423b8663ce8b060d68d
-
SHA1
8576f3d191cdda7057ef123717f4858e6888f648
-
SHA256
a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca
-
SHA512
754ff1ee10ad058a549fdbc990f4eb49ad31d868e654fac577d6fb5b3cea077d15abd7ccdb3f534596fa50c92380dee1a1ea52c00b4a2db10da5df88c9ea7294
-
SSDEEP
6144:YjluQoStIo5R4nM/40yJhKX0F1YJKgta01Cym9VFV/VYEJPnehEs2uM6iuDjOH2F:YEQoSnqhklJra01CTfNYUneID6iuDiHe
Score
9/10
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 4 IoCs
resource yara_rule behavioral2/memory/1820-6-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4520-26-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1528-30-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3380-31-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral2/memory/1820-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1820-6-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4520-11-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1528-12-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3380-13-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/files/0x0008000000023278-15.dat UPX behavioral2/memory/4520-26-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1528-30-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3380-31-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe -
resource yara_rule behavioral2/memory/1820-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1820-6-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4520-11-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1528-12-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3380-13-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x0008000000023278-15.dat upx behavioral2/memory/4520-26-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1528-30-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3380-31-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\B: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\H: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\L: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\S: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\X: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\A: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\K: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\N: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\R: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\Y: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\I: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\Q: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\U: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\V: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\W: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\P: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\T: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\E: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\G: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\J: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\M: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File opened (read-only) \??\O: a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\lingerie masturbation shower .zip.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File created C:\Program Files\Microsoft Office\Updates\Download\black gang bang lingerie girls castration .mpg.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\fucking uncut cock .mpeg.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File created C:\Program Files\dotnet\shared\gay [milf] girly .zip.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File created C:\Program Files\Microsoft Office\root\Templates\horse several models (Curtney).mpeg.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\american animal lingerie masturbation sweet (Anniston,Tatjana).avi.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\swedish cumshot horse catfight hole .zip.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File created C:\Program Files\Common Files\microsoft shared\tyrkish porn fucking big glans .zip.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\fucking licking (Samantha).avi.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\mssrv.exe a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 3380 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1528 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1820 wrote to memory of 4520 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 99 PID 1820 wrote to memory of 4520 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 99 PID 1820 wrote to memory of 4520 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 99 PID 1820 wrote to memory of 1528 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 101 PID 1820 wrote to memory of 1528 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 101 PID 1820 wrote to memory of 1528 1820 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 101 PID 4520 wrote to memory of 3380 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 102 PID 4520 wrote to memory of 3380 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 102 PID 4520 wrote to memory of 3380 4520 a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe"C:\Users\Admin\AppData\Local\Temp\a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe"C:\Users\Admin\AppData\Local\Temp\a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe"C:\Users\Admin\AppData\Local\Temp\a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3380
-
-
-
C:\Users\Admin\AppData\Local\Temp\a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe"C:\Users\Admin\AppData\Local\Temp\a22ba913534d9c9e438b3f8ce03c17f15cda0643f677708048ca6557987566ca.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:4828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\american animal lingerie masturbation sweet (Anniston,Tatjana).avi.exe
Filesize2.1MB
MD5cf37d3033932827230197e4ab5aabc59
SHA19f3c0cf336a02dc6908451562854283ec968bf85
SHA256b1335eccd4b9b79a7ba1e616a8b61b47bc476a28cad1df6070803c7ee4b4609e
SHA5128675d6f5a709ba4bfeebf2291018e2283b60bb321af00598d62826f6b6545ee389d461f45948f8345df802a10576279207282d85b0977e231bbeea01c8a17f51