Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

095cae47da...f2.exe

windows7_x64

8

095cae47da...f2.exe

windows10_x64

8

Resubmissions

11/06/2021, 09:25

210611-4ldscwwnln 10

11/06/2021, 09:21

210611-h2e98z629s 8

Analysis

  • max time kernel
    87s
  • max time network
    95s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    11/06/2021, 09:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    095cae47da0044f82f4bcc9a5cdf4bc099f3eccd2497b81afcd66c53286bc5f2.exe

  • Size

    304KB

  • MD5

    b38db96edbdac1684268b98c8dcffce7

  • SHA1

    88d410bfa5810af0b3c6add7b4911f7a57ea7213

  • SHA256

    095cae47da0044f82f4bcc9a5cdf4bc099f3eccd2497b81afcd66c53286bc5f2

  • SHA512

    bee65541a8f563d793e6be861ad7e92183c6cfd36e14e558a9c01267d26c759cbc0871bfd6b66c692dfd2161df42705e9db2d9de2ad45d66471b36a4426eaaa3

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\095cae47da0044f82f4bcc9a5cdf4bc099f3eccd2497b81afcd66c53286bc5f2.exe
    "C:\Users\Admin\AppData\Local\Temp\095cae47da0044f82f4bcc9a5cdf4bc099f3eccd2497b81afcd66c53286bc5f2.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Users\Admin\AppData\Local\Temp\1073r.exe
      "C:\Users\Admin\AppData\Local\Temp\1073r.exe" 9 REP
      2⤵
      • Executes dropped EXE
      PID:1296
    • C:\Users\Admin\AppData\Local\Temp\pbuSKfHcSlan.exe
      "C:\Users\Admin\AppData\Local\Temp\pbuSKfHcSlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:1316
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
      2⤵
        PID:1376
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "audioendpointbuilder" /y
          3⤵
            PID:1748
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
          2⤵
            PID:1616
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "audioendpointbuilder" /y
              3⤵
                PID:1840
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" stop "samss" /y
              2⤵
                PID:2044
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "samss" /y
                  3⤵
                    PID:528
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\System32\net.exe" stop "samss" /y
                  2⤵
                    PID:2032
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "samss" /y
                      3⤵
                        PID:1276

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1296-72-0x0000000035000000-0x0000000035054000-memory.dmp

                    Filesize

                    336KB

                    Download

                  • memory/1316-74-0x0000000035000000-0x0000000035054000-memory.dmp

                    Filesize

                    336KB

                    Download

                  • memory/1700-61-0x0000000035000000-0x0000000035054000-memory.dmp

                    Filesize

                    336KB

                    Download

                  • memory/1700-60-0x0000000000220000-0x0000000000246000-memory.dmp

                    Filesize

                    152KB

                    Download

                  • memory/1700-62-0x0000000075011000-0x0000000075013000-memory.dmp

                    Filesize

                    8KB

                    Download