Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2022, 00:05

General

  • Target

    dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe

  • Size

    1021KB

  • MD5

    37bfa8a63b65a6c69955df6bf9c34470

  • SHA1

    b01d44641d40f11a07bba89398f5165c46018e01

  • SHA256

    dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5

  • SHA512

    0760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f

  • SSDEEP

    24576:73Bl9M0GJNn6vmwLkIJlYOsD+qnfwXivATzjDK:73JMXN6Owo+8+qnUivATzH

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe
    "C:\Users\Admin\AppData\Local\Temp\dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\43023.bat" "
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\SysWOW64\reg.exe
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5 /f
        3⤵
        • Modifies registry key
        PID:900
      • C:\Users\Admin\AppData\Local\24912839.exe
        C:\Users\Admin\AppData\Local\24912839.exe -i
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1128

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\24912839.exe

    Filesize

    1021KB

    MD5

    37bfa8a63b65a6c69955df6bf9c34470

    SHA1

    b01d44641d40f11a07bba89398f5165c46018e01

    SHA256

    dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5

    SHA512

    0760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f

  • C:\Users\Admin\AppData\Local\24912839.exe

    Filesize

    1021KB

    MD5

    37bfa8a63b65a6c69955df6bf9c34470

    SHA1

    b01d44641d40f11a07bba89398f5165c46018e01

    SHA256

    dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5

    SHA512

    0760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f

  • C:\Users\Admin\AppData\Local\Temp\43023.bat

    Filesize

    455B

    MD5

    08748be06d3cefe0b58e7cb2a7eeb2ef

    SHA1

    401bc43acf401488d1895fee6a496b3854f5d016

    SHA256

    14b79353f8eba0eb7081168f0a0d1d691e2d752ec1a85a08a394fdf8a46b2ca0

    SHA512

    a4b629a932a8a70afea86bb0718b47979cebb2d8a485399e71dcf4e88e53b0ad41a8b84a8e6c524c05e96c50ff80494ef47bf0df4a94b548c7fbe2d4d3262e33

  • \Users\Admin\AppData\Local\24912839.exe

    Filesize

    1021KB

    MD5

    37bfa8a63b65a6c69955df6bf9c34470

    SHA1

    b01d44641d40f11a07bba89398f5165c46018e01

    SHA256

    dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5

    SHA512

    0760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f

  • \Users\Admin\AppData\Local\24912839.exe

    Filesize

    1021KB

    MD5

    37bfa8a63b65a6c69955df6bf9c34470

    SHA1

    b01d44641d40f11a07bba89398f5165c46018e01

    SHA256

    dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5

    SHA512

    0760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f

  • \Users\Admin\AppData\Local\24912839.exe

    Filesize

    1021KB

    MD5

    37bfa8a63b65a6c69955df6bf9c34470

    SHA1

    b01d44641d40f11a07bba89398f5165c46018e01

    SHA256

    dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5

    SHA512

    0760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f

  • \Users\Admin\AppData\Local\24912839.exe

    Filesize

    1021KB

    MD5

    37bfa8a63b65a6c69955df6bf9c34470

    SHA1

    b01d44641d40f11a07bba89398f5165c46018e01

    SHA256

    dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5

    SHA512

    0760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f

  • memory/1128-70-0x000000000094D000-0x0000000000952000-memory.dmp

    Filesize

    20KB

  • memory/1128-69-0x0000000000400000-0x000000000082F004-memory.dmp

    Filesize

    4.2MB

  • memory/1128-73-0x000000000094D000-0x0000000000952000-memory.dmp

    Filesize

    20KB

  • memory/1128-72-0x0000000000400000-0x000000000082F004-memory.dmp

    Filesize

    4.2MB

  • memory/1184-59-0x00000000009DD000-0x00000000009E2000-memory.dmp

    Filesize

    20KB

  • memory/1184-56-0x00000000009DD000-0x00000000009E2000-memory.dmp

    Filesize

    20KB

  • memory/1184-55-0x0000000000400000-0x000000000082F004-memory.dmp

    Filesize

    4.2MB

  • memory/1184-58-0x0000000000400000-0x000000000082F004-memory.dmp

    Filesize

    4.2MB

  • memory/1184-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

    Filesize

    8KB