Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 02:48
Static task
static1
Behavioral task
behavioral1
Sample
6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe
Resource
win10v2004-20220812-en
General
-
Target
6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe
-
Size
148KB
-
MD5
6924595ad703c1555efacfbdb548df50
-
SHA1
05f148c8f9bd9214a06e018834adfb96b31d2d0b
-
SHA256
6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da
-
SHA512
6388b5d1f1af7b495f44ef9484904203d19b8fea948665dec435c282635b4ff80c7046a3864ef063a429be9acea53517ab733dd7e5b8781f24de96e81fae8274
-
SSDEEP
3072:mmqgvg5gRdVmzz92fZ4iUP0xQJeLe0ex8qI:UGdVsxgZ4NcxQJeLe0ex8q
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1800 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1800 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1112 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1112 wrote to memory of 1748 1112 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe 29 PID 1112 wrote to memory of 1748 1112 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe 29 PID 1112 wrote to memory of 1748 1112 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe 29 PID 1112 wrote to memory of 1748 1112 6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe 29 PID 1748 wrote to memory of 1800 1748 cmd.exe 31 PID 1748 wrote to memory of 1800 1748 cmd.exe 31 PID 1748 wrote to memory of 1800 1748 cmd.exe 31 PID 1748 wrote to memory of 1800 1748 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe"C:\Users\Admin\AppData\Local\Temp\6c880ff92273e4f0ea9bb971d0a0a34bc70e793e283a0ef7258c0fb262a4b9da.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 6c880ff92273e4f0ea9bb971d0a0a34bc72⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-