Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 16:03
Behavioral task
behavioral1
Sample
47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
Resource
win10v2004-20220812-en
General
-
Target
47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
-
Size
104KB
-
MD5
10031182705b3d864db88ccbd1191ca7
-
SHA1
2e8626da1bb8e5a57198a324196fbd64880dc124
-
SHA256
47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe
-
SHA512
fb9768b14bdf6bd65550f9f3ba97ce0cce3c1ec6323cd00ae309b502302141c6269778eaf3edef31e9c9392fc24d76aa453e9d40326c981a35ce1acb9c5ecb12
-
SSDEEP
3072:uetDOSpgJremwXSAvNdH1w4IqeolDHXOMxiU:2Spgxem/4NbTIq9D3Vxi
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1800 trys.exe 372 trys.exe 1216 trys.exe -
resource yara_rule behavioral1/memory/1300-55-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1300-57-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/908-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/908-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/908-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/908-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1300-66-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/908-67-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/908-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0009000000005c51-75.dat upx behavioral1/files/0x0009000000005c51-77.dat upx behavioral1/files/0x0009000000005c51-79.dat upx behavioral1/files/0x0009000000005c51-78.dat upx behavioral1/files/0x0009000000005c51-76.dat upx behavioral1/files/0x0009000000005c51-81.dat upx behavioral1/memory/1800-86-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/908-87-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0009000000005c51-89.dat upx behavioral1/files/0x0009000000005c51-96.dat upx behavioral1/memory/1216-99-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1216-102-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1216-105-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0009000000005c51-107.dat upx behavioral1/memory/1800-111-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1216-112-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/908-114-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1216-113-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1216-115-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/372-116-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1216-118-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/372-119-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 5 IoCs
pid Process 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Users\\Admin\\AppData\\Roaming\\trys.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1300 set thread context of 908 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 27 PID 1800 set thread context of 372 1800 trys.exe 32 PID 1800 set thread context of 1216 1800 trys.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe Token: SeDebugPrivilege 372 trys.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 1800 trys.exe 372 trys.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1300 wrote to memory of 908 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 27 PID 1300 wrote to memory of 908 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 27 PID 1300 wrote to memory of 908 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 27 PID 1300 wrote to memory of 908 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 27 PID 1300 wrote to memory of 908 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 27 PID 1300 wrote to memory of 908 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 27 PID 1300 wrote to memory of 908 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 27 PID 1300 wrote to memory of 908 1300 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 27 PID 908 wrote to memory of 1884 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 28 PID 908 wrote to memory of 1884 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 28 PID 908 wrote to memory of 1884 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 28 PID 908 wrote to memory of 1884 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 28 PID 1884 wrote to memory of 624 1884 cmd.exe 30 PID 1884 wrote to memory of 624 1884 cmd.exe 30 PID 1884 wrote to memory of 624 1884 cmd.exe 30 PID 1884 wrote to memory of 624 1884 cmd.exe 30 PID 908 wrote to memory of 1800 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 31 PID 908 wrote to memory of 1800 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 31 PID 908 wrote to memory of 1800 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 31 PID 908 wrote to memory of 1800 908 47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe 31 PID 1800 wrote to memory of 372 1800 trys.exe 32 PID 1800 wrote to memory of 372 1800 trys.exe 32 PID 1800 wrote to memory of 372 1800 trys.exe 32 PID 1800 wrote to memory of 372 1800 trys.exe 32 PID 1800 wrote to memory of 372 1800 trys.exe 32 PID 1800 wrote to memory of 372 1800 trys.exe 32 PID 1800 wrote to memory of 372 1800 trys.exe 32 PID 1800 wrote to memory of 372 1800 trys.exe 32 PID 1800 wrote to memory of 1216 1800 trys.exe 33 PID 1800 wrote to memory of 1216 1800 trys.exe 33 PID 1800 wrote to memory of 1216 1800 trys.exe 33 PID 1800 wrote to memory of 1216 1800 trys.exe 33 PID 1800 wrote to memory of 1216 1800 trys.exe 33 PID 1800 wrote to memory of 1216 1800 trys.exe 33 PID 1800 wrote to memory of 1216 1800 trys.exe 33 PID 1800 wrote to memory of 1216 1800 trys.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\TQEQB.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f4⤵
- Adds Run key to start application
PID:624
-
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:372
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"4⤵
- Executes dropped EXE
PID:1216
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD56dbb2090ff90500da05a027765cde190
SHA1425b833d9d1df8d6df6e5a59f738058808271949
SHA25671ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881
SHA5127e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3
-
Filesize
104KB
MD594d0c8e56423badde74c62fb26e34f0d
SHA1997a4f15a218bc749c962ec2f12b3688142360e4
SHA2560c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8
SHA512c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e
-
Filesize
104KB
MD594d0c8e56423badde74c62fb26e34f0d
SHA1997a4f15a218bc749c962ec2f12b3688142360e4
SHA2560c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8
SHA512c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e
-
Filesize
104KB
MD594d0c8e56423badde74c62fb26e34f0d
SHA1997a4f15a218bc749c962ec2f12b3688142360e4
SHA2560c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8
SHA512c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e
-
Filesize
104KB
MD594d0c8e56423badde74c62fb26e34f0d
SHA1997a4f15a218bc749c962ec2f12b3688142360e4
SHA2560c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8
SHA512c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e
-
Filesize
104KB
MD594d0c8e56423badde74c62fb26e34f0d
SHA1997a4f15a218bc749c962ec2f12b3688142360e4
SHA2560c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8
SHA512c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e
-
Filesize
104KB
MD594d0c8e56423badde74c62fb26e34f0d
SHA1997a4f15a218bc749c962ec2f12b3688142360e4
SHA2560c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8
SHA512c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e
-
Filesize
104KB
MD594d0c8e56423badde74c62fb26e34f0d
SHA1997a4f15a218bc749c962ec2f12b3688142360e4
SHA2560c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8
SHA512c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e
-
Filesize
104KB
MD594d0c8e56423badde74c62fb26e34f0d
SHA1997a4f15a218bc749c962ec2f12b3688142360e4
SHA2560c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8
SHA512c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e
-
Filesize
104KB
MD594d0c8e56423badde74c62fb26e34f0d
SHA1997a4f15a218bc749c962ec2f12b3688142360e4
SHA2560c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8
SHA512c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e