Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/09/2024, 06:01
Behavioral task
behavioral1
Sample
Ransom.Win32.Tescrypt.exe
Resource
win7-20240903-en
General
-
Target
Ransom.Win32.Tescrypt.exe
-
Size
68KB
-
MD5
ea181c784d007ed62403d5a6c766a610
-
SHA1
a0edb8ef1fd5674a36adc48c218ae951cf17d1c3
-
SHA256
deddb8383fc1b2f35138408351d07b090b9bd8dd3bd43e04d5c3ffd42a6d003a
-
SHA512
34e7c090f22544f01e416c560bdd510bfcba9e0d002567c6050dfd748000abef1bf61d6704f0cde481f0ac90a62134a3b1cd8c6041708152de2a190422c6572a
-
SSDEEP
1536:fgWJBwVSclkxvodVSXq7vTFtb47XPArcxvgLLqZ10CmuJdr:fgWJi1kxvqVCq7LFtE7/ArcxkOZ1Bbdr
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4732 Ransom.Win32.Tescrypt.exe -
Executes dropped EXE 1 IoCs
pid Process 4732 Ransom.Win32.Tescrypt.exe -
resource yara_rule behavioral2/memory/5116-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00090000000233eb-11.dat upx behavioral2/memory/4732-12-0x0000000000400000-0x000000000043A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ransom.Win32.Tescrypt.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 5116 Ransom.Win32.Tescrypt.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 5116 Ransom.Win32.Tescrypt.exe 4732 Ransom.Win32.Tescrypt.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5116 wrote to memory of 4732 5116 Ransom.Win32.Tescrypt.exe 83 PID 5116 wrote to memory of 4732 5116 Ransom.Win32.Tescrypt.exe 83 PID 5116 wrote to memory of 4732 5116 Ransom.Win32.Tescrypt.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransom.Win32.Tescrypt.exe"C:\Users\Admin\AppData\Local\Temp\Ransom.Win32.Tescrypt.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\Ransom.Win32.Tescrypt.exeC:\Users\Admin\AppData\Local\Temp\Ransom.Win32.Tescrypt.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD509be69f0cd232b2540d3694c6e376cd6
SHA14a96e8f0598a69f676738cff9a2684248def9d18
SHA256f8039256e37501d32a8c3e2edacf916d1a752769fe2e4ead834d5546876691e6
SHA5123edca41d0dc14bbcca53cb656a6d487f96369824ba6fcdc0b1deb157254be51fa4961c1edd6d88205909bd52b5c306ccccd772b2c48fd69488e81f1abe122e73