Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 22:21
Static task
static1
Behavioral task
behavioral1
Sample
7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe
Resource
win10v2004-20220812-en
General
-
Target
7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe
-
Size
48KB
-
MD5
7bb98635296eaefa2ba608904757cb70
-
SHA1
6d65e276c1701ba7a6465dbf6fa8b7b95b10ada8
-
SHA256
7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f
-
SHA512
c1c07cc39c705b3a4ee39ef11d6336a59d67d05c4485bbe655afd8a2b0a9ec741c5d1fa4ede3023409798a42c1721b35c451cba7f57a0d030e50694e4ee9cc4d
-
SSDEEP
768:MDx7jsf0pg+pMQ5CQ5UrnhA1X87QVrjkqDCyC:MDx7jI0j4A1X80Vvk6C3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1144 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1144 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1224 7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1224 wrote to memory of 912 1224 7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe 30 PID 1224 wrote to memory of 912 1224 7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe 30 PID 1224 wrote to memory of 912 1224 7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe 30 PID 1224 wrote to memory of 912 1224 7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe 30 PID 912 wrote to memory of 1144 912 cmd.exe 32 PID 912 wrote to memory of 1144 912 cmd.exe 32 PID 912 wrote to memory of 1144 912 cmd.exe 32 PID 912 wrote to memory of 1144 912 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe"C:\Users\Admin\AppData\Local\Temp\7bd94a7bc02b28faf2a69a116cef35d7f8b9fca0347054e636365899dc57479f.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 7bd94a7bc02b28faf2a69a116cef35d7f82⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
-