Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe
Resource
win10v2004-20220812-en
General
-
Target
ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe
-
Size
713KB
-
MD5
65bf8f83dffef62d1579503822c3b790
-
SHA1
df810334f2dd62277e8c431c88fb31f8c57319c2
-
SHA256
ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208
-
SHA512
af7638c01a4f8acb79b5604d0062b8fd3239a77236fc7c5d824ddce0b1a644abb3c93276e6c0550f48083207648229c993aeb75e58fa8d7998679b4cb45b76a1
-
SSDEEP
12288:Vs+ApVpEYSOPuBOawRa9rBDUGNmX65+SxNPFQbGlHYy/mqEcFlp/j4QWSgBFl:itE30yrBIhKHPFQC+mEspLDW9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2024 ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe -
resource yara_rule behavioral1/memory/976-61-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral1/memory/2024-63-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral1/memory/2024-65-0x0000000000400000-0x000000000059D000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 976 ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe 976 ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208 = "C:\\ProgramData\\System\\ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe" ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 976 wrote to memory of 2024 976 ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe 27 PID 976 wrote to memory of 2024 976 ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe 27 PID 976 wrote to memory of 2024 976 ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe 27 PID 976 wrote to memory of 2024 976 ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe"C:\Users\Admin\AppData\Local\Temp\ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:976 -
C:\ProgramData\System\ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe"C:\ProgramData\System\ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208.exe"2⤵
- Executes dropped EXE
PID:2024
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
713KB
MD565bf8f83dffef62d1579503822c3b790
SHA1df810334f2dd62277e8c431c88fb31f8c57319c2
SHA256ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208
SHA512af7638c01a4f8acb79b5604d0062b8fd3239a77236fc7c5d824ddce0b1a644abb3c93276e6c0550f48083207648229c993aeb75e58fa8d7998679b4cb45b76a1
-
Filesize
713KB
MD565bf8f83dffef62d1579503822c3b790
SHA1df810334f2dd62277e8c431c88fb31f8c57319c2
SHA256ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208
SHA512af7638c01a4f8acb79b5604d0062b8fd3239a77236fc7c5d824ddce0b1a644abb3c93276e6c0550f48083207648229c993aeb75e58fa8d7998679b4cb45b76a1
-
Filesize
713KB
MD565bf8f83dffef62d1579503822c3b790
SHA1df810334f2dd62277e8c431c88fb31f8c57319c2
SHA256ba54531fde470207f2fe239c7c340d0529f46eff8c184b25736b3c4f13f72208
SHA512af7638c01a4f8acb79b5604d0062b8fd3239a77236fc7c5d824ddce0b1a644abb3c93276e6c0550f48083207648229c993aeb75e58fa8d7998679b4cb45b76a1