Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    160s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 16:03

General

  • Target

    47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe

  • Size

    104KB

  • MD5

    10031182705b3d864db88ccbd1191ca7

  • SHA1

    2e8626da1bb8e5a57198a324196fbd64880dc124

  • SHA256

    47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe

  • SHA512

    fb9768b14bdf6bd65550f9f3ba97ce0cce3c1ec6323cd00ae309b502302141c6269778eaf3edef31e9c9392fc24d76aa453e9d40326c981a35ce1acb9c5ecb12

  • SSDEEP

    3072:uetDOSpgJremwXSAvNdH1w4IqeolDHXOMxiU:2Spgxem/4NbTIq9D3Vxi

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
    "C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe
      "C:\Users\Admin\AppData\Local\Temp\47e6caf4da828a99ee6772fc3a3905e984e72374194f330010dc93f67fcce6fe.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\TQEQB.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f
          4⤵
          • Adds Run key to start application
          PID:624
      • C:\Users\Admin\AppData\Roaming\trys.exe
        "C:\Users\Admin\AppData\Roaming\trys.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Users\Admin\AppData\Roaming\trys.exe
          "C:\Users\Admin\AppData\Roaming\trys.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:372
        • C:\Users\Admin\AppData\Roaming\trys.exe
          "C:\Users\Admin\AppData\Roaming\trys.exe"
          4⤵
          • Executes dropped EXE
          PID:1216

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TQEQB.bat

    Filesize

    135B

    MD5

    6dbb2090ff90500da05a027765cde190

    SHA1

    425b833d9d1df8d6df6e5a59f738058808271949

    SHA256

    71ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881

    SHA512

    7e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    94d0c8e56423badde74c62fb26e34f0d

    SHA1

    997a4f15a218bc749c962ec2f12b3688142360e4

    SHA256

    0c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8

    SHA512

    c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    94d0c8e56423badde74c62fb26e34f0d

    SHA1

    997a4f15a218bc749c962ec2f12b3688142360e4

    SHA256

    0c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8

    SHA512

    c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    94d0c8e56423badde74c62fb26e34f0d

    SHA1

    997a4f15a218bc749c962ec2f12b3688142360e4

    SHA256

    0c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8

    SHA512

    c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    94d0c8e56423badde74c62fb26e34f0d

    SHA1

    997a4f15a218bc749c962ec2f12b3688142360e4

    SHA256

    0c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8

    SHA512

    c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e

  • \Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    94d0c8e56423badde74c62fb26e34f0d

    SHA1

    997a4f15a218bc749c962ec2f12b3688142360e4

    SHA256

    0c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8

    SHA512

    c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e

  • \Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    94d0c8e56423badde74c62fb26e34f0d

    SHA1

    997a4f15a218bc749c962ec2f12b3688142360e4

    SHA256

    0c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8

    SHA512

    c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e

  • \Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    94d0c8e56423badde74c62fb26e34f0d

    SHA1

    997a4f15a218bc749c962ec2f12b3688142360e4

    SHA256

    0c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8

    SHA512

    c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e

  • \Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    94d0c8e56423badde74c62fb26e34f0d

    SHA1

    997a4f15a218bc749c962ec2f12b3688142360e4

    SHA256

    0c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8

    SHA512

    c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e

  • \Users\Admin\AppData\Roaming\trys.exe

    Filesize

    104KB

    MD5

    94d0c8e56423badde74c62fb26e34f0d

    SHA1

    997a4f15a218bc749c962ec2f12b3688142360e4

    SHA256

    0c04214840aa7f58fcac1d3ed8ea9a04a0191f4d8dca5f501f0486e67f2884c8

    SHA512

    c93b8657c7e3c95f1932aaf441192320a8fb39b2ab924441ea569026bbd110a81bdd43dada27848551a77fca381ef864bd5c16f092ee6fabcb17d0483b6ddb1e

  • memory/372-116-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/372-119-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-84-0x0000000002590000-0x00000000025ED000-memory.dmp

    Filesize

    372KB

  • memory/908-87-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-71-0x00000000765B1000-0x00000000765B3000-memory.dmp

    Filesize

    8KB

  • memory/908-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-67-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-114-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-58-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-65-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-59-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-85-0x0000000002590000-0x00000000025ED000-memory.dmp

    Filesize

    372KB

  • memory/908-61-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-62-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/908-88-0x0000000002590000-0x00000000025ED000-memory.dmp

    Filesize

    372KB

  • memory/1216-112-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1216-113-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1216-98-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1216-99-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1216-102-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1216-105-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1216-115-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1216-118-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1300-55-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/1300-66-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/1300-57-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/1800-111-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/1800-86-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB