Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    46s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    18/09/2022, 09:58

General

  • Target

    tmp.exe

  • Size

    25.0MB

  • MD5

    8499d288543591f172e5f913a765ab25

  • SHA1

    1aad0d141c9e9ca6e388fc1deaf5edac23893cec

  • SHA256

    9e614cbac9f674710de965d9847ace29127d71dc1875e48517f4abce0e324400

  • SHA512

    2af6e6115a4719de3ef2cc8bd3e68fd51b4297879bcf2c09326506ff1097c4f1bc781c9d21f95d17abf13d034bb22b356c46de4b91ac4c94074ff8f52c010360

  • SSDEEP

    786432:AgS7PzmDbPWFQsAhRoyKxg4XOqtgK4V8ubp1lsg:Fq8bOeRFP4L+K3Kb

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    PID:1340

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nst2FAB.tmp\System.dll

    Filesize

    11KB

    MD5

    2ae993a2ffec0c137eb51c8832691bcb

    SHA1

    98e0b37b7c14890f8a599f35678af5e9435906e1

    SHA256

    681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

    SHA512

    2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

  • \Users\Admin\AppData\Local\Temp\nst2FAB.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    13b6a88cf284d0f45619e76191e2b995

    SHA1

    09ebb0eb4b1dca73d354368414906fc5ad667e06

    SHA256

    cb958e21c3935ef7697a2f14d64cae0f9264c91a92d2deeb821ba58852dac911

    SHA512

    2aeeae709d759e34592d8a06c90e58aa747e14d54be95fb133994fdcebb1bdc8bc5d82782d0c8c3cdfd35c7bea5d7105379d3c3a25377a8c958c7b2555b1209e

  • memory/1340-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

    Filesize

    8KB