Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
20/10/2022, 21:11
General
-
Target
523bd5d85c8c03e69700934972c154678ee9a09113839c4243c3b3a597f3e2cd.exe
-
Size
109KB
-
MD5
a00b0e934ffc9b757ecdf209d941a5c0
-
SHA1
07ada1eb9d648d040a423d6ddea977a341f7f0a2
-
SHA256
523bd5d85c8c03e69700934972c154678ee9a09113839c4243c3b3a597f3e2cd
-
SHA512
dfc2d85a7d2073825a18eec14f8676a1166df235bc7d1c2bb52b7a4e43ae8e4d77344614b5e4180e146ea693315d189020ee05e90678bbcbdaf2988b497ddb67
-
SSDEEP
3072:JTbD29WtS209fvFGgCr+zHB7szvphZ5gQrwWwzdFxI+:BbaLBFGNvphZ5HZGdF
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\523bd5d85c8c03e69700934972c154678ee9a09113839c4243c3b3a597f3e2cd.exe"C:\Users\Admin\AppData\Local\Temp\523bd5d85c8c03e69700934972c154678ee9a09113839c4243c3b3a597f3e2cd.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\PjqlzDUk\4QNG1Yp.exe,explorer.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\PjqlzDUk\4QNG1Yp.exe,explorer.exe"3⤵
- Modifies WinLogon for persistence
-
-
-
C:\Users\Admin\AppData\Local\Temp\523bd5d85c8c03e69700934972c154678ee9a09113839c4243c3b3a597f3e2cd.exe"C:\Users\Admin\AppData\Local\Temp\523bd5d85c8c03e69700934972c154678ee9a09113839c4243c3b3a597f3e2cd.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD5a00b0e934ffc9b757ecdf209d941a5c0
SHA107ada1eb9d648d040a423d6ddea977a341f7f0a2
SHA256523bd5d85c8c03e69700934972c154678ee9a09113839c4243c3b3a597f3e2cd
SHA512dfc2d85a7d2073825a18eec14f8676a1166df235bc7d1c2bb52b7a4e43ae8e4d77344614b5e4180e146ea693315d189020ee05e90678bbcbdaf2988b497ddb67
-
Filesize
109KB
MD5a00b0e934ffc9b757ecdf209d941a5c0
SHA107ada1eb9d648d040a423d6ddea977a341f7f0a2
SHA256523bd5d85c8c03e69700934972c154678ee9a09113839c4243c3b3a597f3e2cd
SHA512dfc2d85a7d2073825a18eec14f8676a1166df235bc7d1c2bb52b7a4e43ae8e4d77344614b5e4180e146ea693315d189020ee05e90678bbcbdaf2988b497ddb67
-
Filesize
109KB
MD5a00b0e934ffc9b757ecdf209d941a5c0
SHA107ada1eb9d648d040a423d6ddea977a341f7f0a2
SHA256523bd5d85c8c03e69700934972c154678ee9a09113839c4243c3b3a597f3e2cd
SHA512dfc2d85a7d2073825a18eec14f8676a1166df235bc7d1c2bb52b7a4e43ae8e4d77344614b5e4180e146ea693315d189020ee05e90678bbcbdaf2988b497ddb67
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB