Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2022, 10:18

General

  • Target

    dccdf574feb4ed14718efd3580da529efdb429f05015e70040bc389e45de0935.exe

  • Size

    96KB

  • MD5

    7ab167132649ab567173240f880c9085

  • SHA1

    f74628fcbc1716bc5725398d7d5a69940eb37e1e

  • SHA256

    dccdf574feb4ed14718efd3580da529efdb429f05015e70040bc389e45de0935

  • SHA512

    00e6ce662252d4761778e046c4633fd29b5185066f7da50629a31d06136917bcda8788c08bcbe9efae9660dedf4d55d101b8e452da12c7ef757d6af5d3d96a4b

  • SSDEEP

    1536:0bzDchOULMD/2BzqBRpHf8ZyuBs+/PFilZIi6XI:Az8OrD/2B2d8ZyuRAyX

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dccdf574feb4ed14718efd3580da529efdb429f05015e70040bc389e45de0935.exe
    "C:\Users\Admin\AppData\Local\Temp\dccdf574feb4ed14718efd3580da529efdb429f05015e70040bc389e45de0935.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\Users\Admin\hiineug.exe
      "C:\Users\Admin\hiineug.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1936

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\hiineug.exe

    Filesize

    96KB

    MD5

    91be969145436d9e9dcb7d723c853b37

    SHA1

    36d6d4b15a817e3ad62e3e0fc27408333feea03a

    SHA256

    f81c298a031c4d24a454f4c1ef10eed1e2dc532608b92d944d59c52a035732ce

    SHA512

    a9791ecd173d72c9334951348863a174c74abef85442f041ed1b4c5ee70954cd8b3c78918a1303dd7624724be323bcd429d1d13c01d9d9382dfb28413f21b1ae

  • C:\Users\Admin\hiineug.exe

    Filesize

    96KB

    MD5

    91be969145436d9e9dcb7d723c853b37

    SHA1

    36d6d4b15a817e3ad62e3e0fc27408333feea03a

    SHA256

    f81c298a031c4d24a454f4c1ef10eed1e2dc532608b92d944d59c52a035732ce

    SHA512

    a9791ecd173d72c9334951348863a174c74abef85442f041ed1b4c5ee70954cd8b3c78918a1303dd7624724be323bcd429d1d13c01d9d9382dfb28413f21b1ae

  • \Users\Admin\hiineug.exe

    Filesize

    96KB

    MD5

    91be969145436d9e9dcb7d723c853b37

    SHA1

    36d6d4b15a817e3ad62e3e0fc27408333feea03a

    SHA256

    f81c298a031c4d24a454f4c1ef10eed1e2dc532608b92d944d59c52a035732ce

    SHA512

    a9791ecd173d72c9334951348863a174c74abef85442f041ed1b4c5ee70954cd8b3c78918a1303dd7624724be323bcd429d1d13c01d9d9382dfb28413f21b1ae

  • \Users\Admin\hiineug.exe

    Filesize

    96KB

    MD5

    91be969145436d9e9dcb7d723c853b37

    SHA1

    36d6d4b15a817e3ad62e3e0fc27408333feea03a

    SHA256

    f81c298a031c4d24a454f4c1ef10eed1e2dc532608b92d944d59c52a035732ce

    SHA512

    a9791ecd173d72c9334951348863a174c74abef85442f041ed1b4c5ee70954cd8b3c78918a1303dd7624724be323bcd429d1d13c01d9d9382dfb28413f21b1ae

  • memory/1584-54-0x0000000075241000-0x0000000075243000-memory.dmp

    Filesize

    8KB