Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

15/03/2021, 09:09

210315-2zntzgdr72 8

15/03/2021, 08:51

210315-mj6e5pvb66 8

13/03/2021, 17:09

210313-hrcfblnjbx 8

Analysis

  • max time kernel
    31s
  • max time network
    11s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15/03/2021, 09:09

General

  • Target

    trash.exe

  • Size

    100KB

  • MD5

    7f5227030be3d2ef48aa652af1ec72b0

  • SHA1

    202e7ac1c2aaca8fbeed4ac454ca195a33c9d064

  • SHA256

    4dfc17406a58c6f1ce83a73ce6dd5b343d00fe77d07dfe21d28da13631bfad90

  • SHA512

    4603b758416dac60cb322aae6f3566711b6a4a9b657f6448861553b45b1c737fd3180d2b0bc169ef193a2372e89aba14a4d27a25e0a5eb440ed6c4afafe5f55c

Malware Config

Signatures

  • Modifies extensions of user files 30 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\trash.exe
    "C:\Users\Admin\AppData\Local\Temp\trash.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\trash.exe
      C:\Users\Admin\AppData\Local\Temp\trash
      2⤵
      • Modifies extensions of user files
      • Drops startup file
      PID:1984

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1084-10-0x0000000002620000-0x0000000002624000-memory.dmp

    Filesize

    16KB

  • memory/1084-9-0x0000000002390000-0x0000000002394000-memory.dmp

    Filesize

    16KB

  • memory/1984-5-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1984-4-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1984-6-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1984-8-0x00000000767C1000-0x00000000767C3000-memory.dmp

    Filesize

    8KB

  • memory/1984-12-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/1984-11-0x0000000000413000-0x0000000000414000-memory.dmp

    Filesize

    4KB

  • memory/1984-13-0x0000000000413000-0x0000000000414000-memory.dmp

    Filesize

    4KB