Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 12:44
Static task
static1
Behavioral task
behavioral1
Sample
9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe
Resource
win7-20220812-en
General
-
Target
9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe
-
Size
341KB
-
MD5
634c4b47defc3f1f546f106ed9a5f230
-
SHA1
52d5c6634853b937689505d97d7a082e8e5b44b3
-
SHA256
9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60
-
SHA512
f06cc1dabc40f19c85b249d174b1a3a29c5fb6f9d886c40d1cde0b2e767410f3b4fc6d89f30e4aedf503f5d5d15f038295e92e747dfe5397988cc67dba62bd59
-
SSDEEP
6144:X8Ho8LQeAi56dSoqEl/+WQ7KKdRu6Noi53d7/:X8Ho8LQeAi56dSoqEl/+WQ7KKdRu6No2
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1796 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 whatismyip.akamai.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1348 9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1348 wrote to memory of 1796 1348 9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe 28 PID 1348 wrote to memory of 1796 1348 9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe 28 PID 1348 wrote to memory of 1796 1348 9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe 28 PID 1348 wrote to memory of 1796 1348 9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe"C:\Users\Admin\AppData\Local\Temp\9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\9bed8d03cd7d57bd7eb3a6804d5a8a7a065ac32e7a088876242d16d8d75c2b60.exe" >> NUL2⤵
- Deletes itself
PID:1796
-