Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    73s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/10/2022, 15:18

General

  • Target

    a200cb1502362cf129dba82c75c3a9c2ae4fe5b6a8bbb356beb988ab68ff473f.exe

  • Size

    27KB

  • MD5

    81ea450192015350adc4d2bd3ed83cad

  • SHA1

    fc772d50a440db8ca0b2aa131967fe4c605f25cb

  • SHA256

    a200cb1502362cf129dba82c75c3a9c2ae4fe5b6a8bbb356beb988ab68ff473f

  • SHA512

    00291d31f94af4023446ded613d9088e56edf969be3528e68281617a76cde78a8f6f6b7bba80f4b137452fdf01d4b353c66981786c55749e0f528ad2eff180c4

  • SSDEEP

    384:/hexIQTpHlKXjx99999999Qi6wZKCMfxrZYDdzYHQ+GBgfHZDzkt6DWT:pBl99999999QiDZKCMfxrZYb+GmfBIvT

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a200cb1502362cf129dba82c75c3a9c2ae4fe5b6a8bbb356beb988ab68ff473f.exe
    "C:\Users\Admin\AppData\Local\Temp\a200cb1502362cf129dba82c75c3a9c2ae4fe5b6a8bbb356beb988ab68ff473f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe
      "C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:1812

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

    Filesize

    28KB

    MD5

    878ba8194834b2551b15fd0e484ca4ad

    SHA1

    d27273bb4fd9c6db12e4da9fecc2bc554a77eb1a

    SHA256

    70ae2789b9cf9eecfbb37d2f39131d6592860126a82f34683c275e772b52dbbd

    SHA512

    8a8891644c47b18c852fc9dc35f00fb0bba4d431ca062387f24f2c3b1daa43cd9d105a9333fb36768ab43ac9c9864aa3c99d9ba6e577c0bfa05f940c7de16e45

  • C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

    Filesize

    28KB

    MD5

    878ba8194834b2551b15fd0e484ca4ad

    SHA1

    d27273bb4fd9c6db12e4da9fecc2bc554a77eb1a

    SHA256

    70ae2789b9cf9eecfbb37d2f39131d6592860126a82f34683c275e772b52dbbd

    SHA512

    8a8891644c47b18c852fc9dc35f00fb0bba4d431ca062387f24f2c3b1daa43cd9d105a9333fb36768ab43ac9c9864aa3c99d9ba6e577c0bfa05f940c7de16e45

  • \Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

    Filesize

    28KB

    MD5

    878ba8194834b2551b15fd0e484ca4ad

    SHA1

    d27273bb4fd9c6db12e4da9fecc2bc554a77eb1a

    SHA256

    70ae2789b9cf9eecfbb37d2f39131d6592860126a82f34683c275e772b52dbbd

    SHA512

    8a8891644c47b18c852fc9dc35f00fb0bba4d431ca062387f24f2c3b1daa43cd9d105a9333fb36768ab43ac9c9864aa3c99d9ba6e577c0bfa05f940c7de16e45

  • memory/1192-54-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1192-55-0x0000000076701000-0x0000000076703000-memory.dmp

    Filesize

    8KB

  • memory/1192-56-0x0000000002610000-0x0000000002A10000-memory.dmp

    Filesize

    4.0MB

  • memory/1192-60-0x0000000002D60000-0x0000000002D6A000-memory.dmp

    Filesize

    40KB

  • memory/1192-63-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1812-61-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1812-65-0x0000000002640000-0x0000000002A40000-memory.dmp

    Filesize

    4.0MB

  • memory/1812-66-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB