Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    40s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 11:56

General

  • Target

    fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe

  • Size

    73KB

  • MD5

    3297bf438ec0d26ae6b3e63427a7e5c3

  • SHA1

    76b255aba8a9ee6b4b6a95a779fa7d3c9b81be5c

  • SHA256

    fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3

  • SHA512

    25e298b49a90bc4d32993ae189724e05af83cdb068bb4ac2d8630ecea8427432b43bf94fe9b0bb218edf755385f1e699499750d059d69e5f71a15b3a3d8c0390

  • SSDEEP

    1536:4LbwC+enZ4A/5ldZ9EdXFqRcGWUmRxd01Ml6tq7UL/mq/:QTnZ4wAXAvjmHd0gstp

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe
    "C:\Users\Admin\AppData\Local\Temp\fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Jdz..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:1760

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Jdz..bat

    Filesize

    274B

    MD5

    4e82a169c02e9c844c2aa2999d65033f

    SHA1

    1bc5a88f48fe6e99dea95ec970c851493c8d4dfa

    SHA256

    15bc83536c31e3f08fcc34304e64de91db1124c22e229a71191cd4b4b49fe6a2

    SHA512

    f2f4deacd69a0de2d0f3f6412bb98cefaa26ed35411bbcd1a6a0b6acd090832c0a51d8dd08b6d6defb0724650e60248a993007fd2d2da725b2e2c51bf3e4b7d1

  • memory/1468-54-0x0000000075211000-0x0000000075213000-memory.dmp

    Filesize

    8KB

  • memory/1468-55-0x00000000002C0000-0x00000000002ED000-memory.dmp

    Filesize

    180KB

  • memory/1468-56-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1468-58-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB