Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 15:27
Static task
static1
Behavioral task
behavioral1
Sample
e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe
Resource
win10v2004-20220812-en
General
-
Target
e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe
-
Size
54KB
-
MD5
6ef3267168a623c1e5eb94af9d6d6c44
-
SHA1
e1b78fae417f6325d63683fc16121be30e4c8953
-
SHA256
e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a
-
SHA512
7b936c7cc92eabfc710e4e140189322203147595056d08ac0c9e644284a8e567c7d55d73a2b747aa337071a8a81031e6fcb0f28622ae9d5603a5978eeef9dd29
-
SSDEEP
768:N6jSqssYbfDWjXDXr8eGEOYSWFBxOV5UPigcFI0:N6jS7sYnWbDXgelFBxqOaTI0
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1008 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 584 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 584 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1464 e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1008 1464 e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe 28 PID 1464 wrote to memory of 1008 1464 e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe 28 PID 1464 wrote to memory of 1008 1464 e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe 28 PID 1464 wrote to memory of 1008 1464 e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe 28 PID 1008 wrote to memory of 584 1008 cmd.exe 30 PID 1008 wrote to memory of 584 1008 cmd.exe 30 PID 1008 wrote to memory of 584 1008 cmd.exe 30 PID 1008 wrote to memory of 584 1008 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe"C:\Users\Admin\AppData\Local\Temp\e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del e56d22d8fd29c0d0649a67b2a5f5aa8bbe8978a6ddfe432e4e908808e6a6c82a.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:584
-
-