Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 00:05
Static task
static1
Behavioral task
behavioral1
Sample
dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe
Resource
win10v2004-20220901-en
General
-
Target
dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe
-
Size
1021KB
-
MD5
37bfa8a63b65a6c69955df6bf9c34470
-
SHA1
b01d44641d40f11a07bba89398f5165c46018e01
-
SHA256
dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5
-
SHA512
0760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f
-
SSDEEP
24576:73Bl9M0GJNn6vmwLkIJlYOsD+qnfwXivATzjDK:73JMXN6Owo+8+qnUivATzH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1128 24912839.exe -
Deletes itself 1 IoCs
pid Process 1748 cmd.exe -
Loads dropped DLL 4 IoCs
pid Process 1748 cmd.exe 1748 cmd.exe 1128 24912839.exe 1128 24912839.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\24912839 = "\"C:\\Users\\Admin\\AppData\\Local\\24912839.exe\" 0 44 " 24912839.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5 = "\"C:\\Users\\Admin\\AppData\\Local\\24912839.exe\" 0 42 " dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 24912839.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 1 IoCs
pid Process 900 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1128 24912839.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe 1128 24912839.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1184 wrote to memory of 1748 1184 dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe 26 PID 1184 wrote to memory of 1748 1184 dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe 26 PID 1184 wrote to memory of 1748 1184 dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe 26 PID 1184 wrote to memory of 1748 1184 dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe 26 PID 1748 wrote to memory of 900 1748 cmd.exe 28 PID 1748 wrote to memory of 900 1748 cmd.exe 28 PID 1748 wrote to memory of 900 1748 cmd.exe 28 PID 1748 wrote to memory of 900 1748 cmd.exe 28 PID 1748 wrote to memory of 1128 1748 cmd.exe 29 PID 1748 wrote to memory of 1128 1748 cmd.exe 29 PID 1748 wrote to memory of 1128 1748 cmd.exe 29 PID 1748 wrote to memory of 1128 1748 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe"C:\Users\Admin\AppData\Local\Temp\dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\43023.bat" "2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5 /f3⤵
- Modifies registry key
PID:900
-
-
C:\Users\Admin\AppData\Local\24912839.exeC:\Users\Admin\AppData\Local\24912839.exe -i3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1128
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1021KB
MD537bfa8a63b65a6c69955df6bf9c34470
SHA1b01d44641d40f11a07bba89398f5165c46018e01
SHA256dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5
SHA5120760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f
-
Filesize
1021KB
MD537bfa8a63b65a6c69955df6bf9c34470
SHA1b01d44641d40f11a07bba89398f5165c46018e01
SHA256dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5
SHA5120760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f
-
Filesize
455B
MD508748be06d3cefe0b58e7cb2a7eeb2ef
SHA1401bc43acf401488d1895fee6a496b3854f5d016
SHA25614b79353f8eba0eb7081168f0a0d1d691e2d752ec1a85a08a394fdf8a46b2ca0
SHA512a4b629a932a8a70afea86bb0718b47979cebb2d8a485399e71dcf4e88e53b0ad41a8b84a8e6c524c05e96c50ff80494ef47bf0df4a94b548c7fbe2d4d3262e33
-
Filesize
1021KB
MD537bfa8a63b65a6c69955df6bf9c34470
SHA1b01d44641d40f11a07bba89398f5165c46018e01
SHA256dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5
SHA5120760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f
-
Filesize
1021KB
MD537bfa8a63b65a6c69955df6bf9c34470
SHA1b01d44641d40f11a07bba89398f5165c46018e01
SHA256dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5
SHA5120760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f
-
Filesize
1021KB
MD537bfa8a63b65a6c69955df6bf9c34470
SHA1b01d44641d40f11a07bba89398f5165c46018e01
SHA256dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5
SHA5120760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f
-
Filesize
1021KB
MD537bfa8a63b65a6c69955df6bf9c34470
SHA1b01d44641d40f11a07bba89398f5165c46018e01
SHA256dadf243e50c026878292ed0767781618f1232b15c7db7e5f3cdca10323392df5
SHA5120760eb78f6ccb4bf6c60ed72ca442f2daa2e2977f4fb497154eec1c69e4b1d1fce424aaa7c858a8126b20f78f56a2f320185a0c8c1339e8332cc4770bd7eec9f