Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26/10/2022, 12:40

General

  • Target

    57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe

  • Size

    3.6MB

  • MD5

    f863dc33ad476c34dfd139230acebbde

  • SHA1

    126698d59579a0c020b8ec140a0009b0aeb8fc4c

  • SHA256

    57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b

  • SHA512

    f4bab399ada745adf26411984357226a874dcf0b3b611d237d132814ee2b325e1da7e553da9edef35f0251ae8251eeeedbb01b167471f98f938cb0337623c03c

  • SSDEEP

    98304:Z8rPoBhz6aRxcSUDk36SAEdhvxWa9v5y3R8yAdR:Z8rPe6Cxcxk3ZAEUatuR8yA

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Detects WannaCry Ransomware 1 IoCs
  • Contacts a large (1290) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe
    "C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe"
    1⤵
    • Drops file in Windows directory
    PID:1048
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:1760
  • C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe
    C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe -m security
    1⤵
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:960

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    36894136c411d876af4b2b06056826c9

    SHA1

    2d949657e2bc0fa932f106a47eece4ea589e8a6b

    SHA256

    a60453c65fdb211bf2a0c45b73977fbd6ed1bfd46de262e76e4d56a5027e0209

    SHA512

    f614ee19874b17448da9fb677a9b2f8b73e5498d8d20a7a2769baa4354c1c99be5f75d1a55265d2b0a923c5c6a559f41eb02bd799c07fe9338af312f5dc48952

  • memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmp

    Filesize

    8KB