Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 22:37

General

  • Target

    c485b9d4b40bdc2eeb3bf439ff8b68c5740de6166de7850afc182561997d2367.exe

  • Size

    724KB

  • MD5

    65222c169deb5e43793a0cef3041f0c0

  • SHA1

    7cf799a88ba1362e094d5e7b804ad3eea8067911

  • SHA256

    c485b9d4b40bdc2eeb3bf439ff8b68c5740de6166de7850afc182561997d2367

  • SHA512

    b706103acb55b79c615bb08659539b9aea9a33c022834468839e061e12aceb808a38c62a70149f57c0b4aead12ef0f026f98758d35734df2d299d20d101c2115

  • SSDEEP

    12288:71/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0SmMYSwpTzbS+oRHkwuHSgAIIaiM7dWG6:71/aGLDCM4D8ayGMOmMYF7oRHkwuHSNz

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c485b9d4b40bdc2eeb3bf439ff8b68c5740de6166de7850afc182561997d2367.exe
    "C:\Users\Admin\AppData\Local\Temp\c485b9d4b40bdc2eeb3bf439ff8b68c5740de6166de7850afc182561997d2367.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\ProgramData\iqaxnd.exe
      "C:\ProgramData\iqaxnd.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:844

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    269KB

    MD5

    d882647ae95e92c82bd66478d7043df3

    SHA1

    52f1b2c5ff9fe97ade8a034c1df965b21b6f2008

    SHA256

    93ba5be8e47ad44f8d31ff6b142e6c21de473b5c725e8b798279f8b0f31d4232

    SHA512

    ec1416cd7b9d251d6c687c87d3626a4b1879debd50d69050a8be6f01475d53f022919aa1a0cb56e14bd6eae316259c2681eb5bc9ad0e01ed909d9aba0a52dce2

  • C:\ProgramData\iqaxnd.exe

    Filesize

    454KB

    MD5

    febe1eb718a844db96cb87d364ea64e5

    SHA1

    708e27c523cb9ef99efb11021ed6cb6f2c31253e

    SHA256

    7d04a70aad08717018a55a15db8dc4a2a838d9b829a5fee79dec9c57c94f3e14

    SHA512

    a68d625f91a365f1d725e09f19933e4b089d209ef347486f207c9112c45a8abe54b497b64f0e286eecaa5810f117d0c9b8a4c8282b54c28bfd27019325152596

  • C:\ProgramData\iqaxnd.exe

    Filesize

    454KB

    MD5

    febe1eb718a844db96cb87d364ea64e5

    SHA1

    708e27c523cb9ef99efb11021ed6cb6f2c31253e

    SHA256

    7d04a70aad08717018a55a15db8dc4a2a838d9b829a5fee79dec9c57c94f3e14

    SHA512

    a68d625f91a365f1d725e09f19933e4b089d209ef347486f207c9112c45a8abe54b497b64f0e286eecaa5810f117d0c9b8a4c8282b54c28bfd27019325152596

  • \ProgramData\iqaxnd.exe

    Filesize

    454KB

    MD5

    febe1eb718a844db96cb87d364ea64e5

    SHA1

    708e27c523cb9ef99efb11021ed6cb6f2c31253e

    SHA256

    7d04a70aad08717018a55a15db8dc4a2a838d9b829a5fee79dec9c57c94f3e14

    SHA512

    a68d625f91a365f1d725e09f19933e4b089d209ef347486f207c9112c45a8abe54b497b64f0e286eecaa5810f117d0c9b8a4c8282b54c28bfd27019325152596

  • \ProgramData\iqaxnd.exe

    Filesize

    454KB

    MD5

    febe1eb718a844db96cb87d364ea64e5

    SHA1

    708e27c523cb9ef99efb11021ed6cb6f2c31253e

    SHA256

    7d04a70aad08717018a55a15db8dc4a2a838d9b829a5fee79dec9c57c94f3e14

    SHA512

    a68d625f91a365f1d725e09f19933e4b089d209ef347486f207c9112c45a8abe54b497b64f0e286eecaa5810f117d0c9b8a4c8282b54c28bfd27019325152596

  • memory/1408-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

    Filesize

    8KB

  • memory/1408-60-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB