Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 22:47

General

  • Target

    b7bb0e57e15031300626ea10185c88d475df5092eeef1aadce32364ab26b31cb.exe

  • Size

    212KB

  • MD5

    449960739523f5d884fde52d9029111c

  • SHA1

    0457f549a40053bb54ce8b6b3bbdb2de75b9e4bc

  • SHA256

    b7bb0e57e15031300626ea10185c88d475df5092eeef1aadce32364ab26b31cb

  • SHA512

    40dff16eb685ca368c412f5293efee2ff72bbf2d49cc9a78a8ffc0ce51ae2a94eeb7d6a4d16446195eb8f5d0cbd729b4b12b4d7c4fe013d42fc3c273c69af5bf

  • SSDEEP

    3072:kvCh2UjpESCFd3MiaDN/bG0sCOL5pNk+ZxybSAx:0JFd3MiK/SxCOL5pi

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7bb0e57e15031300626ea10185c88d475df5092eeef1aadce32364ab26b31cb.exe
    "C:\Users\Admin\AppData\Local\Temp\b7bb0e57e15031300626ea10185c88d475df5092eeef1aadce32364ab26b31cb.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\teerie.exe
      "C:\Users\Admin\teerie.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2036

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\teerie.exe

    Filesize

    212KB

    MD5

    cc83c66236080ee259a8e4963076c9c6

    SHA1

    d2e95aef72c5985aec8276645452360d5ceec8bd

    SHA256

    30d2cc73ffe23d1b9e7fcdec98162fbafc0b2d6fff3f2ea15586647bda41779b

    SHA512

    b1acc9f53b1b3ba9a4348cadaa7aa515c2690355343b0e3f5d18d487df0bd9f82eef8ddfc2acd627c3d53f83b9fda8deaba382b85c757e50b49961fb058f384c

  • C:\Users\Admin\teerie.exe

    Filesize

    212KB

    MD5

    cc83c66236080ee259a8e4963076c9c6

    SHA1

    d2e95aef72c5985aec8276645452360d5ceec8bd

    SHA256

    30d2cc73ffe23d1b9e7fcdec98162fbafc0b2d6fff3f2ea15586647bda41779b

    SHA512

    b1acc9f53b1b3ba9a4348cadaa7aa515c2690355343b0e3f5d18d487df0bd9f82eef8ddfc2acd627c3d53f83b9fda8deaba382b85c757e50b49961fb058f384c

  • \Users\Admin\teerie.exe

    Filesize

    212KB

    MD5

    cc83c66236080ee259a8e4963076c9c6

    SHA1

    d2e95aef72c5985aec8276645452360d5ceec8bd

    SHA256

    30d2cc73ffe23d1b9e7fcdec98162fbafc0b2d6fff3f2ea15586647bda41779b

    SHA512

    b1acc9f53b1b3ba9a4348cadaa7aa515c2690355343b0e3f5d18d487df0bd9f82eef8ddfc2acd627c3d53f83b9fda8deaba382b85c757e50b49961fb058f384c

  • \Users\Admin\teerie.exe

    Filesize

    212KB

    MD5

    cc83c66236080ee259a8e4963076c9c6

    SHA1

    d2e95aef72c5985aec8276645452360d5ceec8bd

    SHA256

    30d2cc73ffe23d1b9e7fcdec98162fbafc0b2d6fff3f2ea15586647bda41779b

    SHA512

    b1acc9f53b1b3ba9a4348cadaa7aa515c2690355343b0e3f5d18d487df0bd9f82eef8ddfc2acd627c3d53f83b9fda8deaba382b85c757e50b49961fb058f384c

  • memory/1672-56-0x00000000753C1000-0x00000000753C3000-memory.dmp

    Filesize

    8KB