Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

968dac9bd7...80.exe

windows7-x64

7

968dac9bd7...80.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    95s
  • max time network
    103s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2022, 10:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    968dac9bd77fcf56ee14aafc9e190c8911f152d9acb36f183e2923d37ad66380.exe

  • Size

    126KB

  • MD5

    74a5c7e6ea938324e05d0c0e64b09fb0

  • SHA1

    99f25305bb571300c7621d5e92dd195a0c9d1cf2

  • SHA256

    968dac9bd77fcf56ee14aafc9e190c8911f152d9acb36f183e2923d37ad66380

  • SHA512

    29f315b007e894f6733d098a8b8e475b41069dd4bb36e4489b836ea5417a374b43ddcf4f86761618d6211a3a3bd2132002645a794a520c30f19152460e7e407b

  • SSDEEP

    1536:GQV6ZVHYt11f3F+p4f3T4Bonhn/CrrrlX8+wfyYc3QuF/H3gytusDQv3gyOKqHZB:GQsZVHYt11fRkbYGQuFvV2WPKIFiMGU

Score
7/10
persistence

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\968dac9bd77fcf56ee14aafc9e190c8911f152d9acb36f183e2923d37ad66380.exe
    "C:\Users\Admin\AppData\Local\Temp\968dac9bd77fcf56ee14aafc9e190c8911f152d9acb36f183e2923d37ad66380.exe"
    1⤵
    • Drops startup file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Temp\968dac9bd77fcf56ee14aafc9e190c8911f152d9acb36f183e2923d37ad66380.exe
      C:\Users\Admin\AppData\Local\Temp\968dac9bd77fcf56ee14aafc9e190c8911f152d9acb36f183e2923d37ad66380.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1984
    • C:\Windows\SysWOW64\regedit.exe
      regedit /s C:\1.reg
      2⤵
      • Adds Run key to start application
      • Runs .reg file with regedit
      PID:1492

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\1.reg
    Filesize

    171B

    MD5

    7bac0e21336d0f2c2675e3f505865b15

    SHA1

    42bdd2dc1af32e7bbf53f9da29b4f9bd30175f67

    SHA256

    55b4fa8e6b525e667f8f42808595601e918fa510710f15ffd78b7b288603b682

    SHA512

    51c66b0ad2d34f5188639bb55fe054ebbb0040e2c67fd386f7831984ad5f2c1ef6769e3e01583c9aae4a159b237dddb97b7b133dd1e5104c0fe63705da75a624

    Download Submit

  • memory/1976-56-0x0000000074D81000-0x0000000074D83000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1976-64-0x0000000005721000-0x00000000065CD000-memory.dmp

    Filesize

    14.7MB

    Download