Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    5s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2022, 16:54

General

  • Target

    fonts/AlaskanNights.ttf

  • Size

    86KB

  • MD5

    6023142ebf3036a781a79c411aaa0131

  • SHA1

    a37c1f9d5d252f9b16fab911a13332229d735a8b

  • SHA256

    5be4c4b438cb72291ce80ee536dbca19226a1801e7a8906cfc20d1e499f64da8

  • SHA512

    e3f68ec5335de1eb058e26c023522a4747469572439c7c8b3b0cde84cd8d7a11385703ac40a5149eb626701af731522f67579841da30650078bc2edc24672f95

  • SSDEEP

    1536:d5ydfOTA+yFfcMS/l9QY0CKrK9ngh6+QsTvDgGagGoJ0JjFmQ:d5gfAA+qfcMhY0CCcK6dOMG1GD

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\fonts\AlaskanNights.ttf
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Windows\System32\fontview.exe
      "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\fonts\AlaskanNights.ttf
      2⤵
        PID:1572

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1336-54-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

      Filesize

      8KB