Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    16/09/2022, 05:41

General

  • Target

    tmp.exe

  • Size

    44KB

  • MD5

    d18cd40115084975be66a5581546d094

  • SHA1

    7c2f20aa9b518162defd728d2ad88c18f4b78830

  • SHA256

    afc7756b2e9479d748dc9424bf2639ff27107756e2a010a15e0002ccb0c270ce

  • SHA512

    991178a124fa153896a87a5b8f9ee8aa17fb4fffa3adea11c6a9a180ffe73f220392a1edd0b180421539a03a36bb502c9dec4d6d2261fd0b3f25c79c0398ffcb

  • SSDEEP

    768:6fXKTHyY+h6oDeQGPL4vzZq2o9W7GsxBbPr:eX2SCoDlGCq2iW7z

Score
8/10

Malware Config

Signatures

  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\DklsfF.exe
      C:\Users\Admin\AppData\Local\Temp\DklsfF.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1852
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\01f56eda.bat" "
        3⤵
          PID:752

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\01f56eda.bat

      Filesize

      187B

      MD5

      c22009a562b7f034f85bc3298891b5d7

      SHA1

      d1c16bcdde0f1be3348424f6fe4d8b8d92dc570e

      SHA256

      705fc1f2d278a0928404811f73e8c6900403140d9e1dde1ef6f9ab9209abf435

      SHA512

      5918613040432ede5ad2d3ce8638482b41edd45051d654233a90389d97e3b1ea24928e694fab3a8cf8cb644ac98567771a084b663488cc2444684e1803cf5494

    • C:\Users\Admin\AppData\Local\Temp\DklsfF.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • C:\Users\Admin\AppData\Local\Temp\DklsfF.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • \Users\Admin\AppData\Local\Temp\DklsfF.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • \Users\Admin\AppData\Local\Temp\DklsfF.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • memory/1852-59-0x0000000075521000-0x0000000075523000-memory.dmp

      Filesize

      8KB

    • memory/1852-61-0x0000000001030000-0x0000000001039000-memory.dmp

      Filesize

      36KB

    • memory/1852-63-0x0000000001030000-0x0000000001039000-memory.dmp

      Filesize

      36KB

    • memory/2036-57-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB