Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/10/2022, 13:08

General

  • Target

    f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44.exe

  • Size

    298KB

  • MD5

    a1ba185fe310d9ac9f51abbd3319f9c0

  • SHA1

    dea8ca3e7ac3a201fcc4702e6ba8b68aefd086a1

  • SHA256

    f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44

  • SHA512

    7a714be032389fce593c842ce126cdc104a367c4299d95e0c652faf3c3d04b7e8858db033b4bae1324193288fb662a583f43a7abce4a986c7b9c97837894bdb0

  • SSDEEP

    6144:tn6XzoCb5sry2SzUznompQjcRETHSBON8:t2sm2SAM1zzSBON8

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks for any installed AV software in registry 1 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44.exe
    "C:\Users\Admin\AppData\Local\Temp\f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44.exe
      "C:\Users\Admin\AppData\Local\Temp\f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44.exe"
      2⤵
      • Sets file execution options in registry
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks for any installed AV software in registry
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "Windows Update Check - 0x091E01D2" /TR "C:\ProgramData\JavaDebugger0\gtqadjqbe.exe /task" /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:1720
      • C:\ProgramData\JavaDebugger0\gtqadjqbe.exe
        /ins
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\ProgramData\JavaDebugger0\gtqadjqbe.exe
          "C:\ProgramData\JavaDebugger0\gtqadjqbe.exe"
          4⤵
          • Executes dropped EXE
          • Checks for any installed AV software in registry
          • Checks processor information in registry
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1576
          • C:\Windows\SysWOW64\WerFault.exe
            "C:\Windows\SysWOW64\WerFault.exe"
            5⤵
              PID:1548

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\JavaDebugger0\gtqadjqbe.exe

      Filesize

      298KB

      MD5

      a1ba185fe310d9ac9f51abbd3319f9c0

      SHA1

      dea8ca3e7ac3a201fcc4702e6ba8b68aefd086a1

      SHA256

      f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44

      SHA512

      7a714be032389fce593c842ce126cdc104a367c4299d95e0c652faf3c3d04b7e8858db033b4bae1324193288fb662a583f43a7abce4a986c7b9c97837894bdb0

    • C:\ProgramData\JavaDebugger0\gtqadjqbe.exe

      Filesize

      298KB

      MD5

      a1ba185fe310d9ac9f51abbd3319f9c0

      SHA1

      dea8ca3e7ac3a201fcc4702e6ba8b68aefd086a1

      SHA256

      f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44

      SHA512

      7a714be032389fce593c842ce126cdc104a367c4299d95e0c652faf3c3d04b7e8858db033b4bae1324193288fb662a583f43a7abce4a986c7b9c97837894bdb0

    • C:\ProgramData\JavaDebugger0\gtqadjqbe.exe

      Filesize

      298KB

      MD5

      a1ba185fe310d9ac9f51abbd3319f9c0

      SHA1

      dea8ca3e7ac3a201fcc4702e6ba8b68aefd086a1

      SHA256

      f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44

      SHA512

      7a714be032389fce593c842ce126cdc104a367c4299d95e0c652faf3c3d04b7e8858db033b4bae1324193288fb662a583f43a7abce4a986c7b9c97837894bdb0

    • \ProgramData\JavaDebugger0\gtqadjqbe.exe

      Filesize

      298KB

      MD5

      a1ba185fe310d9ac9f51abbd3319f9c0

      SHA1

      dea8ca3e7ac3a201fcc4702e6ba8b68aefd086a1

      SHA256

      f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44

      SHA512

      7a714be032389fce593c842ce126cdc104a367c4299d95e0c652faf3c3d04b7e8858db033b4bae1324193288fb662a583f43a7abce4a986c7b9c97837894bdb0

    • \ProgramData\JavaDebugger0\gtqadjqbe.exe

      Filesize

      298KB

      MD5

      a1ba185fe310d9ac9f51abbd3319f9c0

      SHA1

      dea8ca3e7ac3a201fcc4702e6ba8b68aefd086a1

      SHA256

      f8aa76b12547939ab3ad2b1be17a97c6527e9837a0e46865262f1ba2d2078f44

      SHA512

      7a714be032389fce593c842ce126cdc104a367c4299d95e0c652faf3c3d04b7e8858db033b4bae1324193288fb662a583f43a7abce4a986c7b9c97837894bdb0

    • memory/1548-186-0x0000000077490000-0x0000000077611000-memory.dmp

      Filesize

      1.5MB

    • memory/1548-187-0x000000007EF10000-0x000000007EFA4000-memory.dmp

      Filesize

      592KB

    • memory/1548-184-0x0000000077490000-0x0000000077611000-memory.dmp

      Filesize

      1.5MB

    • memory/1548-185-0x000000007EF10000-0x000000007EFA4000-memory.dmp

      Filesize

      592KB

    • memory/1576-183-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/1576-181-0x00000000002A0000-0x00000000002A9000-memory.dmp

      Filesize

      36KB

    • memory/1576-147-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2016-58-0x0000000000500000-0x0000000000504000-memory.dmp

      Filesize

      16KB

    • memory/2016-70-0x0000000000500000-0x0000000000504000-memory.dmp

      Filesize

      16KB

    • memory/2016-65-0x0000000000500000-0x0000000000504000-memory.dmp

      Filesize

      16KB

    • memory/2016-64-0x0000000000500000-0x0000000000504000-memory.dmp

      Filesize

      16KB

    • memory/2016-63-0x0000000000500000-0x0000000000504000-memory.dmp

      Filesize

      16KB

    • memory/2016-60-0x0000000000500000-0x0000000000504000-memory.dmp

      Filesize

      16KB

    • memory/2016-59-0x0000000000500000-0x0000000000504000-memory.dmp

      Filesize

      16KB

    • memory/2016-62-0x0000000000500000-0x0000000000504000-memory.dmp

      Filesize

      16KB

    • memory/2016-56-0x0000000000500000-0x0000000000504000-memory.dmp

      Filesize

      16KB

    • memory/2032-98-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-112-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-93-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-92-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-91-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-90-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-94-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-95-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-97-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-89-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-99-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-100-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-96-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-102-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-103-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-104-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-101-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-106-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-105-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-107-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-108-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-109-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-110-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-88-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-111-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-113-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-114-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-116-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-115-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-118-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-117-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-87-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2032-86-0x0000000075661000-0x0000000075663000-memory.dmp

      Filesize

      8KB

    • memory/2032-85-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2032-82-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2032-80-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2032-79-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2032-77-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2032-75-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2032-73-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2032-72-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2032-119-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-120-0x0000000000580000-0x0000000000583000-memory.dmp

      Filesize

      12KB

    • memory/2032-121-0x0000000000360000-0x0000000000369000-memory.dmp

      Filesize

      36KB

    • memory/2032-123-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB