Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
39s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
03/10/2022, 20:35
General
-
Target
3fa0616a51d211112aec8d5fb269f054b432ca65989296f56a119e3cbc0b58e2.exe
-
Size
12.2MB
-
MD5
ee7bc5e3ce6b6542e086c35b8e4f327c
-
SHA1
7745dda2c333ed29b92ba1630828deb6a5374b71
-
SHA256
3fa0616a51d211112aec8d5fb269f054b432ca65989296f56a119e3cbc0b58e2
-
SHA512
be658b4e9e77633adfe250df475bdb18bf69468e1d29f092cff05e4ec7755c52ef20d5da955d6b91f8d245da4ce8d780c4b8eed2a2a6b8c7728075c82f080fbd
-
SSDEEP
196608:9GW7q8424qJ0b/o16NTMEdLQR/dpHCKtmCY9BqzWnzlvENqDcifG3Q+WBmYicd0:v284EJ0bjawQR/Hw3pcQG37cG
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fa0616a51d211112aec8d5fb269f054b432ca65989296f56a119e3cbc0b58e2.exe"C:\Users\Admin\AppData\Local\Temp\3fa0616a51d211112aec8d5fb269f054b432ca65989296f56a119e3cbc0b58e2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0LTFB.tmp\3fa0616a51d211112aec8d5fb269f054b432ca65989296f56a119e3cbc0b58e2.tmp"C:\Users\Admin\AppData\Local\Temp\is-0LTFB.tmp\3fa0616a51d211112aec8d5fb269f054b432ca65989296f56a119e3cbc0b58e2.tmp" /SL5="$9012A,12091770,718848,C:\Users\Admin\AppData\Local\Temp\3fa0616a51d211112aec8d5fb269f054b432ca65989296f56a119e3cbc0b58e2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\我的程序\授权-20221001.exe"C:\Program Files (x86)\我的程序\授权-20221001.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\GProtector\GProtector.libC:\GProtector\GProtector.lib4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD56674d5000f63d4d22851daa40e5d8621
SHA18ddd2682a604d238e0549e00750fe45b82c1d222
SHA2563a6e4927ccbb671373cd758c572b592a358ee5dfd97d50e2eece02abd626e3f1
SHA51283922a4aef59813dbe1edd36c86c82ca24132cc943bef3563e4048e4f3d25e0a097ee0bc122113843ecb997af43d4f38e84dff31284cc7af1b26aa442f7d55f5
-
Filesize
18.3MB
MD5dd61179ce217d0ea35b68b4c41e3f8d1
SHA10fbbbc129329376d90982b344bf93cfdad4949fa
SHA25662de854303da3cce18ff0023233fbc4013ac9e0df1ef564fdc3649978b9c0c2f
SHA5125a58fde474d1c105125988053d9b5bcae106b6a72a7f714ea553863f9c5542fd10ef793158ef08f7f3467a863d69c2fb08866e63d5eb15fe567df8b7ab4a1b63
-
Filesize
2.4MB
MD5afcb0ce52f3275932bbe693168cbec61
SHA1aaaaa41948d3984112f6e488c3be447069dc516d
SHA25609e32653389d6b965db754a9edd5f45e782fdb4f19e25a23209e5aac71598e68
SHA512a10416d6825f8a5db60cccc04cfa3de08f64e309d25078a4ec3c42a626d6b1575666cf965f1cc40a645f332d00bbafff522dcbea1851d09aea444f6ca60d0416
-
Filesize
2.4MB
MD5afcb0ce52f3275932bbe693168cbec61
SHA1aaaaa41948d3984112f6e488c3be447069dc516d
SHA25609e32653389d6b965db754a9edd5f45e782fdb4f19e25a23209e5aac71598e68
SHA512a10416d6825f8a5db60cccc04cfa3de08f64e309d25078a4ec3c42a626d6b1575666cf965f1cc40a645f332d00bbafff522dcbea1851d09aea444f6ca60d0416
-
Filesize
1.8MB
MD56674d5000f63d4d22851daa40e5d8621
SHA18ddd2682a604d238e0549e00750fe45b82c1d222
SHA2563a6e4927ccbb671373cd758c572b592a358ee5dfd97d50e2eece02abd626e3f1
SHA51283922a4aef59813dbe1edd36c86c82ca24132cc943bef3563e4048e4f3d25e0a097ee0bc122113843ecb997af43d4f38e84dff31284cc7af1b26aa442f7d55f5
-
Filesize
1.8MB
MD56674d5000f63d4d22851daa40e5d8621
SHA18ddd2682a604d238e0549e00750fe45b82c1d222
SHA2563a6e4927ccbb671373cd758c572b592a358ee5dfd97d50e2eece02abd626e3f1
SHA51283922a4aef59813dbe1edd36c86c82ca24132cc943bef3563e4048e4f3d25e0a097ee0bc122113843ecb997af43d4f38e84dff31284cc7af1b26aa442f7d55f5
-
Filesize
18.3MB
MD5dd61179ce217d0ea35b68b4c41e3f8d1
SHA10fbbbc129329376d90982b344bf93cfdad4949fa
SHA25662de854303da3cce18ff0023233fbc4013ac9e0df1ef564fdc3649978b9c0c2f
SHA5125a58fde474d1c105125988053d9b5bcae106b6a72a7f714ea553863f9c5542fd10ef793158ef08f7f3467a863d69c2fb08866e63d5eb15fe567df8b7ab4a1b63
-
Filesize
18.3MB
MD5dd61179ce217d0ea35b68b4c41e3f8d1
SHA10fbbbc129329376d90982b344bf93cfdad4949fa
SHA25662de854303da3cce18ff0023233fbc4013ac9e0df1ef564fdc3649978b9c0c2f
SHA5125a58fde474d1c105125988053d9b5bcae106b6a72a7f714ea553863f9c5542fd10ef793158ef08f7f3467a863d69c2fb08866e63d5eb15fe567df8b7ab4a1b63
-
Filesize
2.4MB
MD5afcb0ce52f3275932bbe693168cbec61
SHA1aaaaa41948d3984112f6e488c3be447069dc516d
SHA25609e32653389d6b965db754a9edd5f45e782fdb4f19e25a23209e5aac71598e68
SHA512a10416d6825f8a5db60cccc04cfa3de08f64e309d25078a4ec3c42a626d6b1575666cf965f1cc40a645f332d00bbafff522dcbea1851d09aea444f6ca60d0416
-
Filesize
8KB
-
Filesize
556KB
-
Filesize
8KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
756KB