Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    86s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 00:27

General

  • Target

    a391bb08599272bd16b725a56744f40f61bfa7663d76d400f2406487bc259348.exe

  • Size

    164KB

  • MD5

    6e39e2dc76fa82b23954eae4c9aa7b90

  • SHA1

    db974627cd29cf26fd4c8b7ea3421a9af62c00c6

  • SHA256

    a391bb08599272bd16b725a56744f40f61bfa7663d76d400f2406487bc259348

  • SHA512

    040e26945e65fc9e47c9ff2b2113c0f4b3542cdb5a6cc6096519bb4876bcdf2864cdb99a89f3a62df78dd829391f2d1b54927528906ad201704492084d0c46f0

  • SSDEEP

    3072:hsUaAUANtoYj3Bc8T828UAw1XiazCgaN8L2YAgt4oQZiEZ9:gAxoaxc8Y28I1XiUq8sg/Wd

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 54 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a391bb08599272bd16b725a56744f40f61bfa7663d76d400f2406487bc259348.exe
    "C:\Users\Admin\AppData\Local\Temp\a391bb08599272bd16b725a56744f40f61bfa7663d76d400f2406487bc259348.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\hoaze.exe
      "C:\Users\Admin\hoaze.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:948

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\hoaze.exe

    Filesize

    164KB

    MD5

    5e0b199e129206b937514be0019d704b

    SHA1

    597adde094f5c07f5377171810d8a6c017a9b346

    SHA256

    e1df8d7bc200066ce4e4223f66c1849e7142b495dbcb07536645da2a7dd45320

    SHA512

    1224b72c93b4b341e2ddbe85140f72be993567380d8347d863d2664329bdad25b648b24f4a7f0968bc48954ed85b8e4f9061ae1fe6b2045bae3386d6d3a4758d

  • C:\Users\Admin\hoaze.exe

    Filesize

    164KB

    MD5

    5e0b199e129206b937514be0019d704b

    SHA1

    597adde094f5c07f5377171810d8a6c017a9b346

    SHA256

    e1df8d7bc200066ce4e4223f66c1849e7142b495dbcb07536645da2a7dd45320

    SHA512

    1224b72c93b4b341e2ddbe85140f72be993567380d8347d863d2664329bdad25b648b24f4a7f0968bc48954ed85b8e4f9061ae1fe6b2045bae3386d6d3a4758d

  • \Users\Admin\hoaze.exe

    Filesize

    164KB

    MD5

    5e0b199e129206b937514be0019d704b

    SHA1

    597adde094f5c07f5377171810d8a6c017a9b346

    SHA256

    e1df8d7bc200066ce4e4223f66c1849e7142b495dbcb07536645da2a7dd45320

    SHA512

    1224b72c93b4b341e2ddbe85140f72be993567380d8347d863d2664329bdad25b648b24f4a7f0968bc48954ed85b8e4f9061ae1fe6b2045bae3386d6d3a4758d

  • \Users\Admin\hoaze.exe

    Filesize

    164KB

    MD5

    5e0b199e129206b937514be0019d704b

    SHA1

    597adde094f5c07f5377171810d8a6c017a9b346

    SHA256

    e1df8d7bc200066ce4e4223f66c1849e7142b495dbcb07536645da2a7dd45320

    SHA512

    1224b72c93b4b341e2ddbe85140f72be993567380d8347d863d2664329bdad25b648b24f4a7f0968bc48954ed85b8e4f9061ae1fe6b2045bae3386d6d3a4758d

  • memory/1668-56-0x0000000076711000-0x0000000076713000-memory.dmp

    Filesize

    8KB