Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 07:36
Static task
static1
Behavioral task
behavioral1
Sample
4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe
Resource
win10v2004-20220812-en
General
-
Target
4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe
-
Size
44KB
-
MD5
63fb6a6c26832825086d4ff5727153a0
-
SHA1
a32088b47bcc5dca84965cf10e17f73e92e2979b
-
SHA256
4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf
-
SHA512
13cf6a2a56779b8300f9291afda1ddcec260a96a1a9844284a687f1e3bdbbd9231edf23db8927d43644325edca6309e522e60c741ef65b51929a4ab0b8fb3e0f
-
SSDEEP
384:cbE8r54uJsHa0NLnIzx0x2b2vjPxz3w8Du3jsBYRAGryf4pxI/6ps2QdhA4I7m36:eE8auAakDI90Ksw8gpyf4pxGAv5N
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1612 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1644 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1644 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 620 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 620 wrote to memory of 1612 620 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe 28 PID 620 wrote to memory of 1612 620 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe 28 PID 620 wrote to memory of 1612 620 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe 28 PID 620 wrote to memory of 1612 620 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe 28 PID 1612 wrote to memory of 1644 1612 cmd.exe 30 PID 1612 wrote to memory of 1644 1612 cmd.exe 30 PID 1612 wrote to memory of 1644 1612 cmd.exe 30 PID 1612 wrote to memory of 1644 1612 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe"C:\Users\Admin\AppData\Local\Temp\4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 4f74f90b51f8b0db0d1d3e62a82a8af88956fa7a8bac6409f412444dd14e4aaf.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-