Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 23:18

General

  • Target

    306f40b033c5b2f7096fa2623519bd2b2b20b60aadea0c7e7c8139fded1688e2.exe

  • Size

    789KB

  • MD5

    55000550a6e2ff6fa8e63ae500786be0

  • SHA1

    6e9eafa54c82e516e3841455b3a3c22fa7df4824

  • SHA256

    306f40b033c5b2f7096fa2623519bd2b2b20b60aadea0c7e7c8139fded1688e2

  • SHA512

    36b37360d065269c63513b14e30a795892b64d9b4fa6cc8f957ea30fe4edef748ea904abde6adcfe207028a7d6289a0c1d9ebd3a0e13835972a410cf28830c7a

  • SSDEEP

    12288:aSP2Vu2On5XQlE983JNsUDvlkd73hS3n8H5PGFAyG/Q7wv5J:1/2On5XakphS305P4An/9j

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\306f40b033c5b2f7096fa2623519bd2b2b20b60aadea0c7e7c8139fded1688e2.exe
    "C:\Users\Admin\AppData\Local\Temp\306f40b033c5b2f7096fa2623519bd2b2b20b60aadea0c7e7c8139fded1688e2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2036

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\dfs4C0F.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • \Users\Admin\AppData\Local\Temp\dfs4C0F.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • memory/2036-56-0x0000000001E60000-0x0000000001EEC000-memory.dmp

    Filesize

    560KB

  • memory/2036-57-0x0000000000220000-0x000000000022C000-memory.dmp

    Filesize

    48KB

  • memory/2036-58-0x0000000076151000-0x0000000076153000-memory.dmp

    Filesize

    8KB

  • memory/2036-59-0x0000000001FE7000-0x0000000001FF8000-memory.dmp

    Filesize

    68KB