Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 08:54

General

  • Target

    5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe

  • Size

    66KB

  • MD5

    8a87ccb64420febaf0bdf6ac971125b8

  • SHA1

    23175f30c382acfe102cc6470aa347c761e82885

  • SHA256

    5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae

  • SHA512

    13c7b95a72593fb407393669c961d91043cef9cde0dbc26b58b61d65e8ec79ddb87f858eb40f21c9be39a689ccf5f8caf82aab5e330d4e1467882c66a77c8927

  • SSDEEP

    1536:PMPBTxV+1ADAx2p82Ug8KCRO3ZJlb/Lkb3gXC:PMPBgADAs89RGtgcXC

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe
    "C:\Users\Admin\AppData\Local\Temp\5ee3874fea2a7c0a1d6ce234a934d7d9cc41cbe3e1eb48c4443075c6874f11ae.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Msb..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Msb..bat

    Filesize

    274B

    MD5

    0753a14cab8809b3837b9f06ef3bc6f5

    SHA1

    22a8587cf10a75e7a4c78f73798a00c306e1f6fa

    SHA256

    fd6916c4640410f01ebb573e2e142baaccdb5b67e411dcf18a0610538750d5f0

    SHA512

    fe07db2034e463ecb455348576f3150115948018cf31f12bb8c5607466f15d4f1d60a13ec66ea6977bc54093c3fcf3f06496a69bee9d225efa1e4be406e01968

  • memory/1288-54-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1288-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

    Filesize

    8KB

  • memory/1288-56-0x0000000000310000-0x000000000032E000-memory.dmp

    Filesize

    120KB

  • memory/1288-57-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1288-58-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1288-60-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB