Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce.exe
Resource
win10v2004-20220812-en
General
-
Target
524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce.exe
-
Size
90KB
-
MD5
70e95da6f50f50eaeb73263133b9ece6
-
SHA1
ad7873d938b0d4c419388dff4255fbac144f405c
-
SHA256
524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce
-
SHA512
29e0205bddad839dce905f9692016d4a54fc28c7e16b2a4973fe0d770b66d5e73ec4ae618b1d99b35a5f8f9905c9d8b9f24a538e67ea8971225e89e650004108
-
SSDEEP
1536:NerX86+/2o8HNRWkoj/DAJzFXavPhVUbPWBGFarEBhFI+L:ErXr+/2o8XZoTDAJgPYrQGfBhFIq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1728 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1728 1976 524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce.exe 28 PID 1976 wrote to memory of 1728 1976 524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce.exe 28 PID 1976 wrote to memory of 1728 1976 524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce.exe 28 PID 1976 wrote to memory of 1728 1976 524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce.exe"C:\Users\Admin\AppData\Local\Temp\524eb95816ba5ca5e967fba5a41e0dc984c02e219a6ea89d058f49d2910838ce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Qvv..bat" > nul 2> nul2⤵
- Deletes itself
PID:1728
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274B
MD5c56e81fde35fdbca3ca58a7d54b6b067
SHA1c9e298cded0406b882561c53887bc56a1df8f91c
SHA256d8149913419c6e89eb89379f309391e2ab34c7a651d404d9726c4d182185cd8c
SHA512fd086c0fc060e9fc17b58ec8364027964a9f5cb2332bc6171eec5269e101f98831fa35f764abd17960c34f39f17f89a2d3818b2f8bcf4af190e518a33a511f33