Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    72s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 12:06

General

  • Target

    d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe

  • Size

    168KB

  • MD5

    6f712a49b0fc5e071c1888f663409a8e

  • SHA1

    252a49be406cdab0b0c5fac2a2fddba2b2466ec3

  • SHA256

    d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac

  • SHA512

    f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c

  • SSDEEP

    3072:ARqEC2Oi8NXC797F8TBfFvj4bq57441/ynWn1b1oHkay/0A:AHC2F8NXC796TB9vj484KyW/oRy/l

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 61 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe
    "C:\Users\Admin\AppData\Local\Temp\d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe"
    1⤵
    • UAC bypass
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\winrar.exe
      "C:\Users\Admin\AppData\Local\Temp\winrar.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1532
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\winrar.exe" "winrar.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:556
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:468
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\SysWOW64\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\winrar.vbe"
        3⤵
          PID:844

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\winrar.exe

      Filesize

      168KB

      MD5

      6f712a49b0fc5e071c1888f663409a8e

      SHA1

      252a49be406cdab0b0c5fac2a2fddba2b2466ec3

      SHA256

      d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac

      SHA512

      f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c

    • C:\Users\Admin\AppData\Local\Temp\winrar.exe

      Filesize

      168KB

      MD5

      6f712a49b0fc5e071c1888f663409a8e

      SHA1

      252a49be406cdab0b0c5fac2a2fddba2b2466ec3

      SHA256

      d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac

      SHA512

      f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c

    • C:\Users\Admin\AppData\Local\Temp\winrar.vbe

      Filesize

      54B

      MD5

      952afda02bc1cd283a751deb49be3c31

      SHA1

      d7c8f7db20e5b6936dbc7e14ed9110f809cf79f0

      SHA256

      9a0ac6df92f923d3e8e272b0154ae572c70e4dba7a31042f6f37866780f61412

      SHA512

      3460ff6ec848789aa16086c8c4d195ce623a5fa18ecfbdab127487ae155af9fd2a6b465f176ed68491281c1566da65662c5d02e1bebbfe66d20abfdde1ed0134

    • \Users\Admin\AppData\Local\Temp\winrar.exe

      Filesize

      168KB

      MD5

      6f712a49b0fc5e071c1888f663409a8e

      SHA1

      252a49be406cdab0b0c5fac2a2fddba2b2466ec3

      SHA256

      d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac

      SHA512

      f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c

    • \Users\Admin\AppData\Local\Temp\winrar.exe

      Filesize

      168KB

      MD5

      6f712a49b0fc5e071c1888f663409a8e

      SHA1

      252a49be406cdab0b0c5fac2a2fddba2b2466ec3

      SHA256

      d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac

      SHA512

      f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c

    • memory/1532-70-0x0000000000020000-0x0000000000038000-memory.dmp

      Filesize

      96KB

    • memory/1532-74-0x0000000073F70000-0x000000007451B000-memory.dmp

      Filesize

      5.7MB

    • memory/1532-84-0x0000000073F70000-0x000000007451B000-memory.dmp

      Filesize

      5.7MB

    • memory/1640-65-0x0000000073F70000-0x000000007451B000-memory.dmp

      Filesize

      5.7MB

    • memory/1640-75-0x0000000073F70000-0x000000007451B000-memory.dmp

      Filesize

      5.7MB

    • memory/1640-54-0x0000000000220000-0x0000000000238000-memory.dmp

      Filesize

      96KB

    • memory/1640-64-0x0000000073F70000-0x000000007451B000-memory.dmp

      Filesize

      5.7MB

    • memory/1640-63-0x0000000075071000-0x0000000075073000-memory.dmp

      Filesize

      8KB