Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 01:50

General

  • Target

    399ae129b70e02db67d2ea0f23d841e3446ad5b6796fae78fc30afba5c3fa9b0.exe

  • Size

    316KB

  • MD5

    804b3d6995918f4af1ef931e1fcc5d30

  • SHA1

    93d9ad359c02fb8e6318ed7a1350759748779111

  • SHA256

    399ae129b70e02db67d2ea0f23d841e3446ad5b6796fae78fc30afba5c3fa9b0

  • SHA512

    20ca027b000ecb412cf8ed56fc3586d3517cf9346e6419e72162ba2e9d80599dedda1824ece9e6ac0b29a7a7d2eff176b330441c8479a225cfcc6ee7659bc679

  • SSDEEP

    6144:s/JVYOayCTEtWff9nQMdkxIV0OQotoBOm8ntGUcF6/DsEfNXqkEL+:eJVYOy9YxIToYmtyIx+

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\399ae129b70e02db67d2ea0f23d841e3446ad5b6796fae78fc30afba5c3fa9b0.exe
    "C:\Users\Admin\AppData\Local\Temp\399ae129b70e02db67d2ea0f23d841e3446ad5b6796fae78fc30afba5c3fa9b0.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Users\Admin\geitii.exe
      "C:\Users\Admin\geitii.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2000

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\geitii.exe

    Filesize

    316KB

    MD5

    9423749a93d4660861a858bca0a69375

    SHA1

    3a5b360ba6b33bb5a9db5f66bd279420635ae15f

    SHA256

    39c3cab7ae24ae21fd7b5b5faa0e7f04925c338870af27136dd44c8f7160d5b7

    SHA512

    fa9daf9e6ac5014f20794d195131e4e1f215b20e9a09a6cc1e8f6c20f1b33896b1061b64656fa6ad852a3b62bc0a3c997f0bf043edf33580923eb1bc2f341c57

  • C:\Users\Admin\geitii.exe

    Filesize

    316KB

    MD5

    9423749a93d4660861a858bca0a69375

    SHA1

    3a5b360ba6b33bb5a9db5f66bd279420635ae15f

    SHA256

    39c3cab7ae24ae21fd7b5b5faa0e7f04925c338870af27136dd44c8f7160d5b7

    SHA512

    fa9daf9e6ac5014f20794d195131e4e1f215b20e9a09a6cc1e8f6c20f1b33896b1061b64656fa6ad852a3b62bc0a3c997f0bf043edf33580923eb1bc2f341c57

  • \Users\Admin\geitii.exe

    Filesize

    316KB

    MD5

    9423749a93d4660861a858bca0a69375

    SHA1

    3a5b360ba6b33bb5a9db5f66bd279420635ae15f

    SHA256

    39c3cab7ae24ae21fd7b5b5faa0e7f04925c338870af27136dd44c8f7160d5b7

    SHA512

    fa9daf9e6ac5014f20794d195131e4e1f215b20e9a09a6cc1e8f6c20f1b33896b1061b64656fa6ad852a3b62bc0a3c997f0bf043edf33580923eb1bc2f341c57

  • \Users\Admin\geitii.exe

    Filesize

    316KB

    MD5

    9423749a93d4660861a858bca0a69375

    SHA1

    3a5b360ba6b33bb5a9db5f66bd279420635ae15f

    SHA256

    39c3cab7ae24ae21fd7b5b5faa0e7f04925c338870af27136dd44c8f7160d5b7

    SHA512

    fa9daf9e6ac5014f20794d195131e4e1f215b20e9a09a6cc1e8f6c20f1b33896b1061b64656fa6ad852a3b62bc0a3c997f0bf043edf33580923eb1bc2f341c57

  • memory/1884-56-0x0000000075571000-0x0000000075573000-memory.dmp

    Filesize

    8KB