Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe
Resource
win10v2004-20220812-en
General
-
Target
56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe
-
Size
331KB
-
MD5
a21afcbb38a68ba46e76d99dc2f82ec0
-
SHA1
a21106247d6d545158e66b739138301c0185b174
-
SHA256
56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97
-
SHA512
8ecb28a2a24f91cf8f8d72bac6f8ea24a166f9d534d736de430ebd32b092f4f2762a6e23a5e79f533e0e1bd8c5e57bf6e13a02079249216a6e6235e2ce9474ae
-
SSDEEP
6144:+0gVC0TeKb8ug2h+guJE8BpImwxaRAaC6XrgIHYH:+0KFTNs2szJImfAaCSHYH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 652 akappb.exe -
Deletes itself 1 IoCs
pid Process 1144 cmd.exe -
Loads dropped DLL 3 IoCs
pid Process 1144 cmd.exe 1144 cmd.exe 652 akappb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1936 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1732 PING.EXE -
Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1936 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 652 akappb.exe 652 akappb.exe 652 akappb.exe 652 akappb.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1144 1388 56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe 26 PID 1388 wrote to memory of 1144 1388 56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe 26 PID 1388 wrote to memory of 1144 1388 56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe 26 PID 1388 wrote to memory of 1144 1388 56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe 26 PID 1144 wrote to memory of 1936 1144 cmd.exe 28 PID 1144 wrote to memory of 1936 1144 cmd.exe 28 PID 1144 wrote to memory of 1936 1144 cmd.exe 28 PID 1144 wrote to memory of 1936 1144 cmd.exe 28 PID 1144 wrote to memory of 1732 1144 cmd.exe 30 PID 1144 wrote to memory of 1732 1144 cmd.exe 30 PID 1144 wrote to memory of 1732 1144 cmd.exe 30 PID 1144 wrote to memory of 1732 1144 cmd.exe 30 PID 1144 wrote to memory of 652 1144 cmd.exe 31 PID 1144 wrote to memory of 652 1144 cmd.exe 31 PID 1144 wrote to memory of 652 1144 cmd.exe 31 PID 1144 wrote to memory of 652 1144 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe"C:\Users\Admin\AppData\Local\Temp\56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1388 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\56a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97.exe" & start C:\Users\Admin\AppData\Local\akappb.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 13883⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:1732
-
-
C:\Users\Admin\AppData\Local\akappb.exeC:\Users\Admin\AppData\Local\akappb.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:652
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
331KB
MD5a21afcbb38a68ba46e76d99dc2f82ec0
SHA1a21106247d6d545158e66b739138301c0185b174
SHA25656a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97
SHA5128ecb28a2a24f91cf8f8d72bac6f8ea24a166f9d534d736de430ebd32b092f4f2762a6e23a5e79f533e0e1bd8c5e57bf6e13a02079249216a6e6235e2ce9474ae
-
Filesize
331KB
MD5a21afcbb38a68ba46e76d99dc2f82ec0
SHA1a21106247d6d545158e66b739138301c0185b174
SHA25656a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97
SHA5128ecb28a2a24f91cf8f8d72bac6f8ea24a166f9d534d736de430ebd32b092f4f2762a6e23a5e79f533e0e1bd8c5e57bf6e13a02079249216a6e6235e2ce9474ae
-
Filesize
331KB
MD5a21afcbb38a68ba46e76d99dc2f82ec0
SHA1a21106247d6d545158e66b739138301c0185b174
SHA25656a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97
SHA5128ecb28a2a24f91cf8f8d72bac6f8ea24a166f9d534d736de430ebd32b092f4f2762a6e23a5e79f533e0e1bd8c5e57bf6e13a02079249216a6e6235e2ce9474ae
-
Filesize
331KB
MD5a21afcbb38a68ba46e76d99dc2f82ec0
SHA1a21106247d6d545158e66b739138301c0185b174
SHA25656a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97
SHA5128ecb28a2a24f91cf8f8d72bac6f8ea24a166f9d534d736de430ebd32b092f4f2762a6e23a5e79f533e0e1bd8c5e57bf6e13a02079249216a6e6235e2ce9474ae
-
Filesize
331KB
MD5a21afcbb38a68ba46e76d99dc2f82ec0
SHA1a21106247d6d545158e66b739138301c0185b174
SHA25656a5dfe870b97321288c7c31d589db2f2d1d0971fdae38c4470a0f609e29cd97
SHA5128ecb28a2a24f91cf8f8d72bac6f8ea24a166f9d534d736de430ebd32b092f4f2762a6e23a5e79f533e0e1bd8c5e57bf6e13a02079249216a6e6235e2ce9474ae