Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2022, 09:21

General

  • Target

    d81ee79253f1c91f0af45618ea8217ab1e89ee7fa678f5d60f050e1f32390734.exe

  • Size

    788KB

  • MD5

    730ba9b0c186b6ccb5406c9826c0b0e0

  • SHA1

    89c994298382266b76f8a86da80f1aa1d1dff4bc

  • SHA256

    d81ee79253f1c91f0af45618ea8217ab1e89ee7fa678f5d60f050e1f32390734

  • SHA512

    0bfcac7fece2d9af5bd0b432626a1832a9605c7d4e2b5329e18f1b08176cbc1a559ec95f788385b25dcf9c25a2f354cbbb5346261d8ae95b2cd304d01fb94286

  • SSDEEP

    12288:CSP2Vu2On5XQlE983JNsUDvlkd73hS3n8H5PGFAyG/Q7wv2Q:9/2On5XakphS305P4An/9V

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d81ee79253f1c91f0af45618ea8217ab1e89ee7fa678f5d60f050e1f32390734.exe
    "C:\Users\Admin\AppData\Local\Temp\d81ee79253f1c91f0af45618ea8217ab1e89ee7fa678f5d60f050e1f32390734.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1464

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\dfs34E7.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • \Users\Admin\AppData\Local\Temp\dfs34E7.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • memory/1464-56-0x0000000000330000-0x00000000003BC000-memory.dmp

    Filesize

    560KB

  • memory/1464-57-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1464-58-0x0000000075B51000-0x0000000075B53000-memory.dmp

    Filesize

    8KB

  • memory/1464-59-0x0000000004A77000-0x0000000004A88000-memory.dmp

    Filesize

    68KB

  • memory/1464-60-0x000000000A530000-0x000000000ACD6000-memory.dmp

    Filesize

    7.6MB

  • memory/1464-61-0x0000000004A77000-0x0000000004A88000-memory.dmp

    Filesize

    68KB