Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 14:31
Static task
static1
Behavioral task
behavioral1
Sample
61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe
Resource
win10v2004-20220812-en
General
-
Target
61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe
-
Size
1.2MB
-
MD5
617b022e71a5d40ebdbe5ed9507f028d
-
SHA1
6bbacfabd060d5b75fcc5169ccde812bd50cf762
-
SHA256
61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236
-
SHA512
778f4a0793ff13acec4f9f415df4f0a1c17268af002f923c41c679ab250ef18f2626921f67c5d473e2c3e57f26428be5d6c6fae43be20b712ee26b6e75f1b5c2
-
SSDEEP
24576:ynL83cUxIysopjz8WaSzjq6e9gZoXcYpYc8EigfhmYo1ISI4IBjhD:I4cUcU8k+6nZmYcFjfhmYmnIBjt
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1196 Best Treiner.exe 968 UFR.exe -
resource yara_rule behavioral1/files/0x000a000000012324-60.dat upx behavioral1/memory/968-70-0x0000000000400000-0x0000000000670000-memory.dmp upx behavioral1/memory/968-71-0x0000000000400000-0x0000000000670000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1196 Best Treiner.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1196 Best Treiner.exe 968 UFR.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1196 1760 61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe 27 PID 1760 wrote to memory of 1196 1760 61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe 27 PID 1760 wrote to memory of 1196 1760 61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe 27 PID 1760 wrote to memory of 1196 1760 61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe 27 PID 1760 wrote to memory of 968 1760 61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe 28 PID 1760 wrote to memory of 968 1760 61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe 28 PID 1760 wrote to memory of 968 1760 61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe 28 PID 1760 wrote to memory of 968 1760 61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe 28 PID 1196 wrote to memory of 1108 1196 Best Treiner.exe 29 PID 1196 wrote to memory of 1108 1196 Best Treiner.exe 29 PID 1196 wrote to memory of 1108 1196 Best Treiner.exe 29 PID 1196 wrote to memory of 1108 1196 Best Treiner.exe 29 PID 1196 wrote to memory of 1108 1196 Best Treiner.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe"C:\Users\Admin\AppData\Local\Temp\61a01560ab72e858b18b1f875728063836c29a21df52dbb8f9f270a3e8caa236.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\Best Treiner.exe"C:\Users\Admin\AppData\Local\Temp\Best Treiner.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\Best Treiner.exe"C:\Users\Admin\AppData\Local\Temp\Best Treiner.exe"3⤵PID:1108
-
-
-
C:\Users\Admin\AppData\Local\Temp\UFR.exe"C:\Users\Admin\AppData\Local\Temp\UFR.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:968
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD552c502d749eb4fd9a057abaf0db2a2cd
SHA1ded71c3be511c13ef7e8d10dc7303877a4a31ad9
SHA256777ada5f3cfd81c25781bfb1d9912b94a52412fb81527d2c8d2d1c1f4a04f721
SHA512e70e91ff618fea2fc7726770f7d597c98db65a83052a0564bc59dbf0e90f64d0687ddc95d73a61077562f5da35ecb874bea21110b3c501ecbb9a6ec44ce8ac44
-
Filesize
47KB
MD552c502d749eb4fd9a057abaf0db2a2cd
SHA1ded71c3be511c13ef7e8d10dc7303877a4a31ad9
SHA256777ada5f3cfd81c25781bfb1d9912b94a52412fb81527d2c8d2d1c1f4a04f721
SHA512e70e91ff618fea2fc7726770f7d597c98db65a83052a0564bc59dbf0e90f64d0687ddc95d73a61077562f5da35ecb874bea21110b3c501ecbb9a6ec44ce8ac44
-
Filesize
1015KB
MD5eb40b0fb8931a46620f4a42258969213
SHA1bfd6e0931826144b4b24b83c4abe244eebd330c2
SHA256b935a9835a07ad642fe157e5b57e75092124feb750da2e383ee16593760b747e
SHA51261758a07f0e7b9ea24d385822785b9bc17e039f74105227c04c746c89e1662bece9ff66e28e5b27221e52be5d584c8202a28b400e428ae62ac5869873a14e047
-
Filesize
47KB
MD552c502d749eb4fd9a057abaf0db2a2cd
SHA1ded71c3be511c13ef7e8d10dc7303877a4a31ad9
SHA256777ada5f3cfd81c25781bfb1d9912b94a52412fb81527d2c8d2d1c1f4a04f721
SHA512e70e91ff618fea2fc7726770f7d597c98db65a83052a0564bc59dbf0e90f64d0687ddc95d73a61077562f5da35ecb874bea21110b3c501ecbb9a6ec44ce8ac44