Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 07:43
Static task
static1
Behavioral task
behavioral1
Sample
ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe
Resource
win10v2004-20220812-en
General
-
Target
ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe
-
Size
213KB
-
MD5
6f83316fe200418a9f41da87e22130e0
-
SHA1
7649b7984725a12ed9e5b58ef01069e53891ee34
-
SHA256
ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729
-
SHA512
90528a90cc61c8a97885ce9217b6723d5d66291a4aa5fdbf32e4d743d33b0f45fed1696387ba33802307a483a7da0004def93779a2cfd4e9a5683338bb27d738
-
SSDEEP
6144:4u2urzh9xu/Xkau8w5ndxT3TK3pAF6p5Mk/5o/:4utrzh9xOXkXJdx323pAMp5MJ/
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 844 ui32.exe 268 ui32.exe -
Loads dropped DLL 3 IoCs
pid Process 1340 ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe 1340 ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe 844 ui32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run ui32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ui32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ui32.exe" ui32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 844 set thread context of 268 844 ui32.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 844 ui32.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1340 wrote to memory of 844 1340 ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe 27 PID 1340 wrote to memory of 844 1340 ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe 27 PID 1340 wrote to memory of 844 1340 ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe 27 PID 1340 wrote to memory of 844 1340 ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe 27 PID 1340 wrote to memory of 844 1340 ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe 27 PID 1340 wrote to memory of 844 1340 ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe 27 PID 1340 wrote to memory of 844 1340 ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe 27 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28 PID 844 wrote to memory of 268 844 ui32.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe"C:\Users\Admin\AppData\Local\Temp\ac120fa2467d9a3932f5a86bea24978f8713a4471a72bafb1719686f8f011729.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\ui32.exe"C:\Users\Admin\AppData\Local\Temp\ui32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\ui32.exe"C:\Users\Admin\AppData\Local\Temp\ui32.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:268
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27B
MD5b33236ec368a53794beb8f44c4128f79
SHA13eac83232a5a5cd6f42551814aae6df92888b8b6
SHA256e0f1d608da176665300fcf58467d6bddcbe19fa12600cc0fdbf2ee96b8ed7f37
SHA51205dd97eefd9fe024cd5bc69bb173105d13de8794bcbfa8bc77d925e7e21435cebdbb77f9a8747eaef4a50dd7276ea48513ea5f26f787242ace4494ebec9683f4
-
Filesize
228KB
MD5728c6f049387e93974a39b1b95ff72e7
SHA1502b06ca3baa78a5455ae3f361d0a375e7f1b902
SHA256468a7b9570cab75742ee59489ab1f2ddd861c1214f27524ad0eaecb9ee6b82c4
SHA512e60eb0ae77384758c42ce128016cc615cbcc33cb71462c1749ad001f00ecdb2afbfa7807eba568700f9bb64bf4940d9354440576acfdb989f2b27371dc68d32c
-
Filesize
228KB
MD5728c6f049387e93974a39b1b95ff72e7
SHA1502b06ca3baa78a5455ae3f361d0a375e7f1b902
SHA256468a7b9570cab75742ee59489ab1f2ddd861c1214f27524ad0eaecb9ee6b82c4
SHA512e60eb0ae77384758c42ce128016cc615cbcc33cb71462c1749ad001f00ecdb2afbfa7807eba568700f9bb64bf4940d9354440576acfdb989f2b27371dc68d32c
-
Filesize
228KB
MD5728c6f049387e93974a39b1b95ff72e7
SHA1502b06ca3baa78a5455ae3f361d0a375e7f1b902
SHA256468a7b9570cab75742ee59489ab1f2ddd861c1214f27524ad0eaecb9ee6b82c4
SHA512e60eb0ae77384758c42ce128016cc615cbcc33cb71462c1749ad001f00ecdb2afbfa7807eba568700f9bb64bf4940d9354440576acfdb989f2b27371dc68d32c
-
Filesize
228KB
MD5728c6f049387e93974a39b1b95ff72e7
SHA1502b06ca3baa78a5455ae3f361d0a375e7f1b902
SHA256468a7b9570cab75742ee59489ab1f2ddd861c1214f27524ad0eaecb9ee6b82c4
SHA512e60eb0ae77384758c42ce128016cc615cbcc33cb71462c1749ad001f00ecdb2afbfa7807eba568700f9bb64bf4940d9354440576acfdb989f2b27371dc68d32c
-
Filesize
228KB
MD5728c6f049387e93974a39b1b95ff72e7
SHA1502b06ca3baa78a5455ae3f361d0a375e7f1b902
SHA256468a7b9570cab75742ee59489ab1f2ddd861c1214f27524ad0eaecb9ee6b82c4
SHA512e60eb0ae77384758c42ce128016cc615cbcc33cb71462c1749ad001f00ecdb2afbfa7807eba568700f9bb64bf4940d9354440576acfdb989f2b27371dc68d32c
-
Filesize
228KB
MD5728c6f049387e93974a39b1b95ff72e7
SHA1502b06ca3baa78a5455ae3f361d0a375e7f1b902
SHA256468a7b9570cab75742ee59489ab1f2ddd861c1214f27524ad0eaecb9ee6b82c4
SHA512e60eb0ae77384758c42ce128016cc615cbcc33cb71462c1749ad001f00ecdb2afbfa7807eba568700f9bb64bf4940d9354440576acfdb989f2b27371dc68d32c