Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 16:23
Static task
static1
Behavioral task
behavioral1
Sample
8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe
Resource
win10v2004-20220901-en
General
-
Target
8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe
-
Size
112KB
-
MD5
68a98b2a13fda3c7d1f29e512ef5c52e
-
SHA1
a3b9520cad3cc9db6433ca57bc745781fd1418d7
-
SHA256
8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197
-
SHA512
f311052633089917b79b42f682438e7f388d4e4d53d79660a97f36672b5a6256b6a79d20575d2833f6f4462319f4f435b5c4d5105b16d4b10653a70982cc0eac
-
SSDEEP
1536:E9wrhoUwQFkQZI2LSkS+yiPmuHS/UWrUuOOJE5fiExEENYaIT8fvyJ:E9wuQmQegjTHScWrUmJElxEEC6v
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1688 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1688 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1708 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1752 1708 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe 29 PID 1708 wrote to memory of 1752 1708 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe 29 PID 1708 wrote to memory of 1752 1708 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe 29 PID 1708 wrote to memory of 1752 1708 8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe 29 PID 1752 wrote to memory of 1688 1752 cmd.exe 31 PID 1752 wrote to memory of 1688 1752 cmd.exe 31 PID 1752 wrote to memory of 1688 1752 cmd.exe 31 PID 1752 wrote to memory of 1688 1752 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe"C:\Users\Admin\AppData\Local\Temp\8a28a1d91e732a6310d30f430e970c1b6560b0d00baa23173d8f6acd629ea197.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 8a28a1d91e732a6310d30f430e970c1b652⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-