Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 00:47

General

  • Target

    36bca934b089e6a142e98615073788d9b74e0eb236e8b1a74bdbe0a140c938b0.exe

  • Size

    55KB

  • MD5

    9084e7fbfe5bd6fd827230b1c055cfad

  • SHA1

    35b0dc7a1734cc3f478c1622fc5cad6483fb14c6

  • SHA256

    36bca934b089e6a142e98615073788d9b74e0eb236e8b1a74bdbe0a140c938b0

  • SHA512

    fbed26e50d3f56970591a6a4145f722fb24ac6cf1fbcdb9910716b76b1bfb483d1cc251c6acb93191d180b31e2e5a200ab91dc9c570fc83a42aa454973628523

  • SSDEEP

    768:JeL/fytQjZtwMDvOFUWV7zaWZbmiCwPmOY:JeLnytUZvGFtPllm4u

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36bca934b089e6a142e98615073788d9b74e0eb236e8b1a74bdbe0a140c938b0.exe
    "C:\Users\Admin\AppData\Local\Temp\36bca934b089e6a142e98615073788d9b74e0eb236e8b1a74bdbe0a140c938b0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of UnmapMainImage
    PID:1168

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1168-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

    Filesize

    8KB

  • memory/1168-55-0x0000000000220000-0x0000000000231000-memory.dmp

    Filesize

    68KB

  • memory/1168-56-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB