Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
required d...ts.iso
windows7-x64
3required d...ts.iso
windows10-2004-x64
3OUBcVbISpNCsLG.bat
windows7-x64
10OUBcVbISpNCsLG.bat
windows10-2004-x64
10documents.lnk
windows7-x64
10documents.lnk
windows10-2004-x64
10lXNqexIxTwBWAS.dll
windows7-x64
3lXNqexIxTwBWAS.dll
windows10-2004-x64
3Analysis
-
max time kernel
46s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/10/2022, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
required documents.iso
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
required documents.iso
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
OUBcVbISpNCsLG.bat
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
OUBcVbISpNCsLG.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
documents.lnk
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
documents.lnk
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
lXNqexIxTwBWAS.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
lXNqexIxTwBWAS.dll
Resource
win10v2004-20220812-en
General
-
Target
required documents.iso
-
Size
2.0MB
-
MD5
2de09409720aebd957c2d92316da123c
-
SHA1
7d0d1ee7c6a4d6e38f8165ee9c0b15fc66a5d73c
-
SHA256
2b379f9fd440fb0e6d5e6dc6f65c4fbf17d31840add7f182ceec78514cedd94a
-
SHA512
19bc30965bcd9e29918b8bb2f6f97c2e6c734a3105322615fc8f099f24d0ef2ade97a211ebd023115c930b65c922c6648cc17d6685ada3147381a5d25beb3a7e
-
SSDEEP
49152:iWMIqdgaiFBRzI9sXUd9BqiIirDxLCll+HaVD7RNPb:2IqdiOwQjIiIH+HaVRND
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1732 1760 cmd.exe 29 PID 1760 wrote to memory of 1732 1760 cmd.exe 29 PID 1760 wrote to memory of 1732 1760 cmd.exe 29