Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    61s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 00:00

General

  • Target

    f2441dac87237f355fbfa0474df013f2264b254ff7f2145a93bfb1855ea4e8d6.exe

  • Size

    220KB

  • MD5

    6f32497dd814e6c7596db04ee661734b

  • SHA1

    35a0a3ad81e09386cf6e954e71226dc49c1b6cb2

  • SHA256

    f2441dac87237f355fbfa0474df013f2264b254ff7f2145a93bfb1855ea4e8d6

  • SHA512

    a9fc068f652dacb13038608b4bc187c1e0d5f3760252758f777f16464f0ba9d0fb28fd1312a37869675a6fc1b0fa63eb06b2aa6f641acbc34f5a80c3a79dc473

  • SSDEEP

    1536:rC7dASR5csJawoIZsh0CF+sKE0C1rZL4H0c/7wHeLxjaimtAbe79WCyiHCUXR6Tk:xaMOFCsv/CL0jaQaWCyiHCx1ps40

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2441dac87237f355fbfa0474df013f2264b254ff7f2145a93bfb1855ea4e8d6.exe
    "C:\Users\Admin\AppData\Local\Temp\f2441dac87237f355fbfa0474df013f2264b254ff7f2145a93bfb1855ea4e8d6.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Users\Admin\waupue.exe
      "C:\Users\Admin\waupue.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1568

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\waupue.exe

    Filesize

    220KB

    MD5

    6a5b3c68b48c624a365b40d113b166c9

    SHA1

    92a2ed8e36d960769dd8d0faa9d9aaf4e2551b6c

    SHA256

    86ae0ea35e9889b43a8be40c8c2563fe070cf92f3c492123c2dca60d5c8d83ad

    SHA512

    ddfcce597bce8901319c3df1cc43f563c0ca2dbab88e3eaeed273da47866548a8c90dd7feb47571f4f293c57f1a5cf8704fd59caee626a0d2787f14c1a0caa34

  • C:\Users\Admin\waupue.exe

    Filesize

    220KB

    MD5

    6a5b3c68b48c624a365b40d113b166c9

    SHA1

    92a2ed8e36d960769dd8d0faa9d9aaf4e2551b6c

    SHA256

    86ae0ea35e9889b43a8be40c8c2563fe070cf92f3c492123c2dca60d5c8d83ad

    SHA512

    ddfcce597bce8901319c3df1cc43f563c0ca2dbab88e3eaeed273da47866548a8c90dd7feb47571f4f293c57f1a5cf8704fd59caee626a0d2787f14c1a0caa34

  • \Users\Admin\waupue.exe

    Filesize

    220KB

    MD5

    6a5b3c68b48c624a365b40d113b166c9

    SHA1

    92a2ed8e36d960769dd8d0faa9d9aaf4e2551b6c

    SHA256

    86ae0ea35e9889b43a8be40c8c2563fe070cf92f3c492123c2dca60d5c8d83ad

    SHA512

    ddfcce597bce8901319c3df1cc43f563c0ca2dbab88e3eaeed273da47866548a8c90dd7feb47571f4f293c57f1a5cf8704fd59caee626a0d2787f14c1a0caa34

  • \Users\Admin\waupue.exe

    Filesize

    220KB

    MD5

    6a5b3c68b48c624a365b40d113b166c9

    SHA1

    92a2ed8e36d960769dd8d0faa9d9aaf4e2551b6c

    SHA256

    86ae0ea35e9889b43a8be40c8c2563fe070cf92f3c492123c2dca60d5c8d83ad

    SHA512

    ddfcce597bce8901319c3df1cc43f563c0ca2dbab88e3eaeed273da47866548a8c90dd7feb47571f4f293c57f1a5cf8704fd59caee626a0d2787f14c1a0caa34

  • memory/960-56-0x0000000075141000-0x0000000075143000-memory.dmp

    Filesize

    8KB