Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    80s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2022, 14:57 UTC

General

  • Target

    c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe

  • Size

    204KB

  • MD5

    769874effe38d3976a0a3b8f3fe858d0

  • SHA1

    396d5b98e5f27ad271bc53d35a3c20406ea621d1

  • SHA256

    c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011

  • SHA512

    cdd671620b10e7b1d2bbe3d9dc7ac4c0beb3224389c04dc21d78873f62ad5d470c15577bdeac63a77d3e8f2f3aae69b3d2b2a8ca9702eef76944c5aefdde78e7

  • SSDEEP

    3072:tVeWCGNpDxU+mzihKh8wpzDqulR3X9sDpLg6ZGKIXeYnilDC:tVe47EV82llbs1g6+Xbik

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe
    "C:\Users\Admin\AppData\Local\Temp\c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\mzhoes.exe
      "C:\Users\Admin\mzhoes.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1360

Network

  • flag-us
    DNS
    ns1.spansearcher.net
    c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.spansearcher.net
    IN A
    Response
  • flag-us
    DNS
    ns1.spinsearcher.org
    c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.spinsearcher.org
    IN A
    Response
  • flag-us
    DNS
    ns1.player1352.net
    c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.player1352.net
    IN A
    Response
    ns1.player1352.net
    IN A
    35.205.61.67
  • 35.205.61.67:8000
    ns1.player1352.net
    c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe
    334 B
    212 B
    7
    5
  • 8.8.8.8:53
    ns1.spansearcher.net
    dns
    c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe
    66 B
    139 B
    1
    1

    DNS Request

    ns1.spansearcher.net

  • 8.8.8.8:53
    ns1.spinsearcher.org
    dns
    c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe
    66 B
    148 B
    1
    1

    DNS Request

    ns1.spinsearcher.org

  • 8.8.8.8:53
    ns1.player1352.net
    dns
    c4cc37ba3c423ff7029a3fad5ed3de43724cb1ccea50b2c0bd8c55626068b011.exe
    64 B
    80 B
    1
    1

    DNS Request

    ns1.player1352.net

    DNS Response

    35.205.61.67

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\mzhoes.exe

    Filesize

    204KB

    MD5

    fa5ddcc01da6478ab82ddb6dd648343d

    SHA1

    43520dc84534230adc949689966c049b03901d45

    SHA256

    e69c4f95d729b300ede7853b00c3f032edc4c138efdaa57004e4e84daae5988e

    SHA512

    d193c7089c8e19bd747b578e6030da8dfc4f2171d145977199aa5c2d704d8c686fd50552f8b4e51a37bce445fb9857274c7fbb7d57d5ea63706ac4e20a1aec0d

  • C:\Users\Admin\mzhoes.exe

    Filesize

    204KB

    MD5

    fa5ddcc01da6478ab82ddb6dd648343d

    SHA1

    43520dc84534230adc949689966c049b03901d45

    SHA256

    e69c4f95d729b300ede7853b00c3f032edc4c138efdaa57004e4e84daae5988e

    SHA512

    d193c7089c8e19bd747b578e6030da8dfc4f2171d145977199aa5c2d704d8c686fd50552f8b4e51a37bce445fb9857274c7fbb7d57d5ea63706ac4e20a1aec0d

  • \Users\Admin\mzhoes.exe

    Filesize

    204KB

    MD5

    fa5ddcc01da6478ab82ddb6dd648343d

    SHA1

    43520dc84534230adc949689966c049b03901d45

    SHA256

    e69c4f95d729b300ede7853b00c3f032edc4c138efdaa57004e4e84daae5988e

    SHA512

    d193c7089c8e19bd747b578e6030da8dfc4f2171d145977199aa5c2d704d8c686fd50552f8b4e51a37bce445fb9857274c7fbb7d57d5ea63706ac4e20a1aec0d

  • \Users\Admin\mzhoes.exe

    Filesize

    204KB

    MD5

    fa5ddcc01da6478ab82ddb6dd648343d

    SHA1

    43520dc84534230adc949689966c049b03901d45

    SHA256

    e69c4f95d729b300ede7853b00c3f032edc4c138efdaa57004e4e84daae5988e

    SHA512

    d193c7089c8e19bd747b578e6030da8dfc4f2171d145977199aa5c2d704d8c686fd50552f8b4e51a37bce445fb9857274c7fbb7d57d5ea63706ac4e20a1aec0d

  • memory/1976-56-0x00000000764D1000-0x00000000764D3000-memory.dmp

    Filesize

    8KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.