Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16/10/2022, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe
Resource
win10v2004-20220812-en
General
-
Target
ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe
-
Size
225KB
-
MD5
0e8476b3c4099a42baca7f16ca8253e6
-
SHA1
e044edce8646124ddc39906e6fb6f02eaff16161
-
SHA256
ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b
-
SHA512
afeeda4d83a38e0ef3307fac88a63ed197a305501c84622151e07be17bd38d8d07ff91c36c832f5574c86165573940258c0d18f681e8346bf869089891b1021a
-
SSDEEP
6144:hRAvJmXbQwAPnZXJAc4V50DErB5xgTw7ozFz254W:hRAxebQwAPAkDWGcoxfW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1500 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe -
Deletes itself 1 IoCs
pid Process 1856 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe = "C:\\Windows\\ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe" ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-2292972927-2705560509-2768824231-1000\desktop.ini ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe File opened (read-only) \??\F: ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe File created C:\Windows\21628076471972527219.png ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 524 taskkill.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.venus ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.venus\DefaultIcon ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.venus\DefaultIcon\ = "C:\\Windows\\21628076471972527219.png" ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1712 PING.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1500 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe Token: SeTcbPrivilege 1500 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe Token: SeTakeOwnershipPrivilege 1500 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe Token: SeSecurityPrivilege 1500 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe Token: SeDebugPrivilege 524 taskkill.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1112 wrote to memory of 1500 1112 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 28 PID 1112 wrote to memory of 1500 1112 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 28 PID 1112 wrote to memory of 1500 1112 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 28 PID 1112 wrote to memory of 1500 1112 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 28 PID 1112 wrote to memory of 1856 1112 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 30 PID 1112 wrote to memory of 1856 1112 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 30 PID 1112 wrote to memory of 1856 1112 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 30 PID 1112 wrote to memory of 1856 1112 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 30 PID 1500 wrote to memory of 1744 1500 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 32 PID 1500 wrote to memory of 1744 1500 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 32 PID 1500 wrote to memory of 1744 1500 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 32 PID 1500 wrote to memory of 1744 1500 ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe 32 PID 1856 wrote to memory of 1712 1856 cmd.exe 31 PID 1856 wrote to memory of 1712 1856 cmd.exe 31 PID 1856 wrote to memory of 1712 1856 cmd.exe 31 PID 1744 wrote to memory of 524 1744 cmd.exe 34 PID 1744 wrote to memory of 524 1744 cmd.exe 34 PID 1744 wrote to memory of 524 1744 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe"C:\Users\Admin\AppData\Local\Temp\ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe"C:\Windows\ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe" g g g o n e1232⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\System32\cmd.exe/C taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\system32\taskkill.exetaskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:524
-
-
-
-
C:\Windows\System32\cmd.exe/c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b.bin.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\system32\PING.EXEping localhost -n 33⤵
- Runs ping.exe
PID:1712
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225KB
MD50e8476b3c4099a42baca7f16ca8253e6
SHA1e044edce8646124ddc39906e6fb6f02eaff16161
SHA256ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b
SHA512afeeda4d83a38e0ef3307fac88a63ed197a305501c84622151e07be17bd38d8d07ff91c36c832f5574c86165573940258c0d18f681e8346bf869089891b1021a