Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    22s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 07:49

General

  • Target

    5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe

  • Size

    93KB

  • MD5

    574262c2484256d298bb1395fc39de2b

  • SHA1

    2472edb4ab746087f7480c440256d5b1cbfa0cb7

  • SHA256

    5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452

  • SHA512

    94e2fa929610830586d2d016b46595baee01ea37497a10220c0cfbf72d7ee42c1e89d84f17a4ae825c0330a41cf7d12862b90e1ccb801620998438de19cf1960

  • SSDEEP

    1536:ze5iRWD7X7c0h4VJtkvmIY7u2Bx8plVL3YIgyyLYvuWQNcpfyKn+hP:zejD77cs4VjomzBx8pld/n7YI+P

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe
    "C:\Users\Admin\AppData\Local\Temp\5b725cad5cbfe32f42c3be301b3eadee07bb60c46af0b753f50ff09776607452.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\backup.exe
      "C:\backup.exe"
      2⤵
      • Executes dropped EXE
      PID:1712

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\backup.exe

    Filesize

    15KB

    MD5

    f90fa1ab4cf6048339fee351d57b9474

    SHA1

    6f2973bd8d6f43f9c08a407e64ddeec4f7570f1c

    SHA256

    91f803c1eb18df1521e75a06ca15dcd781d4dd537f7d19b6cca8641cfcfe9129

    SHA512

    572785d734bd86c4b61f75f5985ca4cb027ce79d3327703daf0c9ca19bff2c77c77d2cbd49cb6cf2a7fdb2cfdff077957100f0e3744dd0e81fe813dab1f40914

  • C:\backup.exe

    Filesize

    15KB

    MD5

    f90fa1ab4cf6048339fee351d57b9474

    SHA1

    6f2973bd8d6f43f9c08a407e64ddeec4f7570f1c

    SHA256

    91f803c1eb18df1521e75a06ca15dcd781d4dd537f7d19b6cca8641cfcfe9129

    SHA512

    572785d734bd86c4b61f75f5985ca4cb027ce79d3327703daf0c9ca19bff2c77c77d2cbd49cb6cf2a7fdb2cfdff077957100f0e3744dd0e81fe813dab1f40914

  • memory/864-54-0x0000000076261000-0x0000000076263000-memory.dmp

    Filesize

    8KB