Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 14:51
Static task
static1
Behavioral task
behavioral1
Sample
3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe
Resource
win10v2004-20220812-en
General
-
Target
3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe
-
Size
251KB
-
MD5
66257a85aecf2e05f1f6c729e250a460
-
SHA1
2d11f10cf55b124356ea53bd1f030292b68f20ac
-
SHA256
3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b
-
SHA512
bd6e832a330efa4450622f1ee85b92dc2e7826b6f0894eb83f9242a641aea5a1603bc6e0e19ef16c20256bb5dcab86aba3116c1a0a33dd1594bd9d9cb784d69b
-
SSDEEP
3072:zI36iNfhv+XWwKWDzN2izzUDm6QpzJ8f2mMsfzVLmC4DGYD1VIT2U2Z:zI366+XWwKWDzTIDmDsdfz4ClY4T2U2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 900 windows.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1864 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecc7c8c51c0850c1ec247c7fd3602f20.exe windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecc7c8c51c0850c1ec247c7fd3602f20.exe windows.exe -
Loads dropped DLL 1 IoCs
pid Process 1200 3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe 900 windows.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 900 windows.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1200 wrote to memory of 900 1200 3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe 27 PID 1200 wrote to memory of 900 1200 3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe 27 PID 1200 wrote to memory of 900 1200 3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe 27 PID 1200 wrote to memory of 900 1200 3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe 27 PID 900 wrote to memory of 1864 900 windows.exe 28 PID 900 wrote to memory of 1864 900 windows.exe 28 PID 900 wrote to memory of 1864 900 windows.exe 28 PID 900 wrote to memory of 1864 900 windows.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe"C:\Users\Admin\AppData\Local\Temp\3a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1864
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD566257a85aecf2e05f1f6c729e250a460
SHA12d11f10cf55b124356ea53bd1f030292b68f20ac
SHA2563a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b
SHA512bd6e832a330efa4450622f1ee85b92dc2e7826b6f0894eb83f9242a641aea5a1603bc6e0e19ef16c20256bb5dcab86aba3116c1a0a33dd1594bd9d9cb784d69b
-
Filesize
251KB
MD566257a85aecf2e05f1f6c729e250a460
SHA12d11f10cf55b124356ea53bd1f030292b68f20ac
SHA2563a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b
SHA512bd6e832a330efa4450622f1ee85b92dc2e7826b6f0894eb83f9242a641aea5a1603bc6e0e19ef16c20256bb5dcab86aba3116c1a0a33dd1594bd9d9cb784d69b
-
Filesize
251KB
MD566257a85aecf2e05f1f6c729e250a460
SHA12d11f10cf55b124356ea53bd1f030292b68f20ac
SHA2563a24e9614c836957c0ffc670f660c63cc44117669dc6805fb2f79953728e717b
SHA512bd6e832a330efa4450622f1ee85b92dc2e7826b6f0894eb83f9242a641aea5a1603bc6e0e19ef16c20256bb5dcab86aba3116c1a0a33dd1594bd9d9cb784d69b