Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe
Resource
win10v2004-20220812-en
General
-
Target
97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe
-
Size
69KB
-
MD5
6cbb2ef706bd5e08ec0f83844b5b7ee0
-
SHA1
90e2964a0f13a2e052efb1436a5613ad29023402
-
SHA256
97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d
-
SHA512
7c958cc8b838baa871c6a8156c92134532e04148032af617582a842f1ad54981c03d54a78ca96399c32c9bbcfad84be76b238be77ffa81111ca507572d7c975d
-
SSDEEP
1536:rJCKOXfuGsRf1kQtnSe+L6ZtTqI1RfXTO:rofX2GsRf1vSBCt71RfD
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\J: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\Q: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\R: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\V: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\W: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\Z: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\B: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\F: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\H: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\K: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\L: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\M: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\S: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\T: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\Y: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\A: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\G: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\N: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\O: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\P: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\X: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\E: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe File opened (read-only) \??\U: 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 940 97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe"C:\Users\Admin\AppData\Local\Temp\97162e0e2208f6e80d4320c275fda69987c42492ebd0288f11a9625232eb784d.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:940