Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe
Resource
win10v2004-20220901-en
General
-
Target
c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe
-
Size
23KB
-
MD5
670817a59c499f302f1f111b05ed96f0
-
SHA1
e6bade97062f0edb99025a2cefb3dc5e5493c512
-
SHA256
c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b
-
SHA512
5b575dd7894b0f62379e248341e74a836d91dc50323cdbdb137257760b784b25122bb7d51db2669c386c539a2c9cd3cb301b325c1faec6c82381118edd63970f
-
SSDEEP
384:a4vr1U11xwC0khzTmrJBSEg5LLjAvyV1SY9vZKIruugVltk1:/JUPR0khCdg5LYvqSY9vZMlVLm
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 576 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 560 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 560 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1720 c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1720 wrote to memory of 576 1720 c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe 28 PID 1720 wrote to memory of 576 1720 c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe 28 PID 1720 wrote to memory of 576 1720 c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe 28 PID 1720 wrote to memory of 576 1720 c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe 28 PID 576 wrote to memory of 560 576 cmd.exe 30 PID 576 wrote to memory of 560 576 cmd.exe 30 PID 576 wrote to memory of 560 576 cmd.exe 30 PID 576 wrote to memory of 560 576 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe"C:\Users\Admin\AppData\Local\Temp\c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del c7d37fd0078ac0125ceb455576288a01a3a42ca1868bca96e28db3ae8957487b.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-