Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2022, 18:25

General

  • Target

    f66c4eea10282e14fe8e080695be8bc45bdebad58afed927ea761a5d16f90fb9.exe

  • Size

    224KB

  • MD5

    0aff7df8cf4d7ee43b118b941c8755e1

  • SHA1

    43f5b707aba51af28df9072dae537b9119a64ed4

  • SHA256

    f66c4eea10282e14fe8e080695be8bc45bdebad58afed927ea761a5d16f90fb9

  • SHA512

    a2c279591c016d4f8b038a4933e91c82b2774db11764b704d5ceaca69d4523f72f8ba4b3c75d30d8eaf869e95e2bd64fd19330f61d55ed3a52088916ee200c37

  • SSDEEP

    3072:gXyqNsMoBuuZVpl2mclbj4Uvx+8ysNOu+2eRcKksU61JkkX39RLrw4ySKUbax2+c:PqN5ep4LnbmlrZ3X

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f66c4eea10282e14fe8e080695be8bc45bdebad58afed927ea761a5d16f90fb9.exe
    "C:\Users\Admin\AppData\Local\Temp\f66c4eea10282e14fe8e080695be8bc45bdebad58afed927ea761a5d16f90fb9.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Users\Admin\mopev.exe
      "C:\Users\Admin\mopev.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2044

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\mopev.exe

    Filesize

    224KB

    MD5

    86eb77870f8a24a757e72d3e7ed0d659

    SHA1

    2b7e019f9ac88019d1f1805112e8aca7bcafa02b

    SHA256

    b734c61fe91092b29d7c9a4af3b06bfba62f49793f9ed4e4f835a7a23d8eb0fc

    SHA512

    ed7237e36aaf9a1b47f4c242ea4671e8440c461b33d68d2b05c7ef09eaf44ce15f456280a9cefdffbaf7c27d3b6f67345a614341076b1ef2f4465cb019f9d113

  • C:\Users\Admin\mopev.exe

    Filesize

    224KB

    MD5

    86eb77870f8a24a757e72d3e7ed0d659

    SHA1

    2b7e019f9ac88019d1f1805112e8aca7bcafa02b

    SHA256

    b734c61fe91092b29d7c9a4af3b06bfba62f49793f9ed4e4f835a7a23d8eb0fc

    SHA512

    ed7237e36aaf9a1b47f4c242ea4671e8440c461b33d68d2b05c7ef09eaf44ce15f456280a9cefdffbaf7c27d3b6f67345a614341076b1ef2f4465cb019f9d113

  • \Users\Admin\mopev.exe

    Filesize

    224KB

    MD5

    86eb77870f8a24a757e72d3e7ed0d659

    SHA1

    2b7e019f9ac88019d1f1805112e8aca7bcafa02b

    SHA256

    b734c61fe91092b29d7c9a4af3b06bfba62f49793f9ed4e4f835a7a23d8eb0fc

    SHA512

    ed7237e36aaf9a1b47f4c242ea4671e8440c461b33d68d2b05c7ef09eaf44ce15f456280a9cefdffbaf7c27d3b6f67345a614341076b1ef2f4465cb019f9d113

  • \Users\Admin\mopev.exe

    Filesize

    224KB

    MD5

    86eb77870f8a24a757e72d3e7ed0d659

    SHA1

    2b7e019f9ac88019d1f1805112e8aca7bcafa02b

    SHA256

    b734c61fe91092b29d7c9a4af3b06bfba62f49793f9ed4e4f835a7a23d8eb0fc

    SHA512

    ed7237e36aaf9a1b47f4c242ea4671e8440c461b33d68d2b05c7ef09eaf44ce15f456280a9cefdffbaf7c27d3b6f67345a614341076b1ef2f4465cb019f9d113

  • memory/1128-56-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

    Filesize

    8KB