Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
35s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe
Resource
win10v2004-20220901-en
General
-
Target
85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe
-
Size
72KB
-
MD5
33e0a944d34133296dc4afbd50048ca0
-
SHA1
aa6e13fa2d8493ead14e4009c8f93159e09b6bc9
-
SHA256
85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05
-
SHA512
74ba1e3cc35f07c48538101693e0fb1b30df770d71c44166877df6f69f476e35ccd32303b3b98ffe6773f4593fa314e959a2f628b345d1974b34b2c25283f6d0
-
SSDEEP
768:/puEF9zcOzyzv8EH2VtwYMh+YpX3BVQNrQQMFY9cGQhnXXpL5XKKKKKKKKKRTP:/pu4x/yzffeMFYSnHZxKKKKKKKKKRL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1332 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 832 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 832 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1612 85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1332 1612 85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe 27 PID 1612 wrote to memory of 1332 1612 85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe 27 PID 1612 wrote to memory of 1332 1612 85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe 27 PID 1612 wrote to memory of 1332 1612 85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe 27 PID 1332 wrote to memory of 832 1332 cmd.exe 29 PID 1332 wrote to memory of 832 1332 cmd.exe 29 PID 1332 wrote to memory of 832 1332 cmd.exe 29 PID 1332 wrote to memory of 832 1332 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe"C:\Users\Admin\AppData\Local\Temp\85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 85d08cdba7fd348e3aeaeddeb5323dde2463852e8af7eda2b38f74f7fdd4ab05.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-