Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
39s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 13:06
Static task
static1
Behavioral task
behavioral1
Sample
819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe
Resource
win10v2004-20220812-en
General
-
Target
819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe
-
Size
127KB
-
MD5
a18ba014aa88c7380e2933e3462c6aeb
-
SHA1
88a96c094935b1a75929cdf8fc8f80aa7923a373
-
SHA256
819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191
-
SHA512
1b6c3ebd6f930de59fff89eda07935ea5b0202709c5eb0dd90c6b8eaabcf68d07788e6ab988bb73d4aa0fbee64fd937070ce4dc4ea9fb0cfb9a21f33281139fa
-
SSDEEP
3072:fTZtv4Ymgik7lC7rD4X1HYWB7MCSswGAPSliBAbUcI5tsRDk:VVSgdC7rD4JKCSDGS+T2tsRDk
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2020 9972114.exe 524 9972114.exe -
Loads dropped DLL 10 IoCs
pid Process 1368 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 1368 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 2020 9972114.exe 584 WerFault.exe 584 WerFault.exe 584 WerFault.exe 584 WerFault.exe 584 WerFault.exe 584 WerFault.exe 584 WerFault.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1108 set thread context of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 2020 set thread context of 524 2020 9972114.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 584 524 WerFault.exe 29 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 2020 9972114.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1108 wrote to memory of 1368 1108 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 27 PID 1368 wrote to memory of 2020 1368 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 28 PID 1368 wrote to memory of 2020 1368 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 28 PID 1368 wrote to memory of 2020 1368 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 28 PID 1368 wrote to memory of 2020 1368 819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe 28 PID 2020 wrote to memory of 524 2020 9972114.exe 29 PID 2020 wrote to memory of 524 2020 9972114.exe 29 PID 2020 wrote to memory of 524 2020 9972114.exe 29 PID 2020 wrote to memory of 524 2020 9972114.exe 29 PID 2020 wrote to memory of 524 2020 9972114.exe 29 PID 2020 wrote to memory of 524 2020 9972114.exe 29 PID 2020 wrote to memory of 524 2020 9972114.exe 29 PID 2020 wrote to memory of 524 2020 9972114.exe 29 PID 524 wrote to memory of 584 524 9972114.exe 30 PID 524 wrote to memory of 584 524 9972114.exe 30 PID 524 wrote to memory of 584 524 9972114.exe 30 PID 524 wrote to memory of 584 524 9972114.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe"C:\Users\Admin\AppData\Local\Temp\819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe"C:\Users\Admin\AppData\Local\Temp\819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\9972114.exe"C:\Users\Admin\AppData\Local\Temp\9972114.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\9972114.exe"C:\Users\Admin\AppData\Local\Temp\9972114.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 365⤵
- Loads dropped DLL
- Program crash
PID:584
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2292972927-2705560509-2768824231-1000\88603cb2913a7df3fbd16b5f958e6447_4339b52c-c4ea-4bc4-b41f-93efca473d02
Filesize51B
MD55fc2ac2a310f49c14d195230b91a8885
SHA190855cc11136ba31758fe33b5cf9571f9a104879
SHA256374e0e2897a7a82e0e44794cad89df0f3cdd7703886239c1fe06d625efd48092
SHA512ab46554df9174b9fe9beba50a640f67534c3812f64d96a1fb8adfdc136dfe730ca2370825cd45b7f87a544d6a58dd868cb5a3a7f42e2789f6d679dbc0fdd52c3
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328
-
Filesize
15KB
MD56521bd152f2dbe3782e847b4903f4672
SHA136ee5caf108d9337d117c713d52d1befc9b68e0b
SHA256050dbf83963a694a41a6a5c1e10acf4de8615de14d6b4430a9646ea737b0c9d2
SHA512a52f4e02d72b8e3f7e3c31c7fb9904f56da5a65b6ad93c3fbcfa0e93163992d55a24fefe593262d645ed4e44c0feb915fb956baf368e5d795e3d270375ed2328