Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 08:54
Static task
static1
Behavioral task
behavioral1
Sample
5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe
Resource
win10v2004-20220812-en
General
-
Target
5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe
-
Size
66KB
-
MD5
8a87ccb64420febaf0bdf6ac971125b8
-
SHA1
23175f30c382acfe102cc6470aa347c761e82885
-
SHA256
5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae
-
SHA512
13c7b95a72593fb407393669c961d91043cef9cde0dbc26b58b61d65e8ec79ddb87f858eb40f21c9be39a689ccf5f8caf82aab5e330d4e1467882c66a77c8927
-
SSDEEP
1536:PMPBTxV+1ADAx2p82Ug8KCRO3ZJlb/Lkb3gXC:PMPBgADAs89RGtgcXC
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 828 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1288 wrote to memory of 828 1288 5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe 27 PID 1288 wrote to memory of 828 1288 5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe 27 PID 1288 wrote to memory of 828 1288 5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe 27 PID 1288 wrote to memory of 828 1288 5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe"C:\Users\Admin\AppData\Local\Temp\5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Msb..bat" > nul 2> nul2⤵
- Deletes itself
PID:828
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274B
MD50753a14cab8809b3837b9f06ef3bc6f5
SHA122a8587cf10a75e7a4c78f73798a00c306e1f6fa
SHA256fd6916c4640410f01ebb573e2e142baaccdb5b67e411dcf18a0610538750d5f0
SHA512fe07db2034e463ecb455348576f3150115948018cf31f12bb8c5607466f15d4f1d60a13ec66ea6977bc54093c3fcf3f06496a69bee9d225efa1e4be406e01968