Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2022, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe
Resource
win10v2004-20220812-en
General
-
Target
9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe
-
Size
201KB
-
MD5
41ac15c7d183d1eaf7489e453c79dc70
-
SHA1
2820ef0f24b1963402b74f42fb3fd0274c019e06
-
SHA256
9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff
-
SHA512
e28813a50a12a4fef6631be3777ba2375ca40e1a6b7c0fc34419b1bdf819572e7c9c703c4714d26ae2e2b31c74c128ad10e8db091260de4a1731ac2d5519cb7d
-
SSDEEP
3072:gQIURTXJf45+tVS18SKpRWeIqEPFN0/4qidXQZSyzwQAY6mv9Mv7og7j9L8:gsF1y18S4W5LF2+QwQ+WMv7jjG
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe 4676 9ba23a60b7c83cabbd9e93600257eaf12cb5057813267329cde37a6f4e1320ff.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
25KB
MD59d8ce05f532dc7b5742831ec8a63c2d8
SHA1b014365f723c78a84bcdf8a46cfa016eb2b8dbc5
SHA256fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982
SHA51298f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe
-
Filesize
25KB
MD59d8ce05f532dc7b5742831ec8a63c2d8
SHA1b014365f723c78a84bcdf8a46cfa016eb2b8dbc5
SHA256fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982
SHA51298f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe
-
Filesize
9KB
MD5c10e04dd4ad4277d5adc951bb331c777
SHA1b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
-
Filesize
9KB
MD5c10e04dd4ad4277d5adc951bb331c777
SHA1b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e