Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 03:27

General

  • Target

    91c414d0f1a677d6d3bd7d890300720a57404a0c943ed99562f93ae7ac9098ac.exe

  • Size

    861KB

  • MD5

    68636da56c83715de2290164bcf756b0

  • SHA1

    5db1c14809b1573a7ee7625db8e8cb23c02f8983

  • SHA256

    91c414d0f1a677d6d3bd7d890300720a57404a0c943ed99562f93ae7ac9098ac

  • SHA512

    a006f38b32e7ad671264f4317c2f7293a78826cce5a937b893dc1466af8be3ae67032a7b89ce144768c1a5a32abe355a5fb7b2f9a96b42f3fcdb3387a121f098

  • SSDEEP

    24576:MRmJkcoQricOIQxiZY1iaC3bqaR5/cT0hO:ZJZoQrbTFZY1iaCNQ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91c414d0f1a677d6d3bd7d890300720a57404a0c943ed99562f93ae7ac9098ac.exe
    "C:\Users\Admin\AppData\Local\Temp\91c414d0f1a677d6d3bd7d890300720a57404a0c943ed99562f93ae7ac9098ac.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:364
    • C:\Users\Admin\AppData\Local\Temp\91c414d0f1a677d6d3bd7d890300720a57404a0c943ed99562f93ae7ac9098ac.exe
      "C:\Users\Admin\AppData\Local\Temp\91c414d0f1a677d6d3bd7d890300720a57404a0c943ed99562f93ae7ac9098ac.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Deletes itself
        • Adds Run key to start application
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1376
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1416
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1416 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1232

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\H036M4TI.txt

    Filesize

    597B

    MD5

    92634ead356e59fa7024658aae62a278

    SHA1

    be98565ed97632215036846aa80b7a35ef89c299

    SHA256

    c9cf2a1b6e844fdb766567153754a5aec7abb9de6e4925c0914b1b9c9cbb3860

    SHA512

    a2c4019701504217b53199b464e160f010ec9a4951b623d8418ae5519897d180e616140be507804700e915134a6fe715aab70722717367d8f76c6ac88aef1a53

  • memory/364-54-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/364-55-0x0000000076681000-0x0000000076683000-memory.dmp

    Filesize

    8KB

  • memory/364-71-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/364-61-0x00000000026D0000-0x0000000002798000-memory.dmp

    Filesize

    800KB

  • memory/1708-66-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1708-62-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1708-64-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1708-59-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1708-70-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1708-57-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1708-72-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1708-75-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1708-76-0x00000000002B0000-0x00000000002FE000-memory.dmp

    Filesize

    312KB

  • memory/1708-56-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB