Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    188s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 23:18

General

  • Target

    2055228256697d8e6c5630360340e9199afb2afe92e34fce28a65fb4043ecdb5.exe

  • Size

    789KB

  • MD5

    83a5dfdf3b0582a07b65a075d48ba730

  • SHA1

    c604afc592ce5018882fd7d058eeabeca4e702cd

  • SHA256

    2055228256697d8e6c5630360340e9199afb2afe92e34fce28a65fb4043ecdb5

  • SHA512

    9b2eb0d17a5d4f55b34b258ee223c811e9fc86182afb8c4bb7e16c5889bd402c9c683ddf2f917341a0dac337e370bc990bbc2f1a8765e7754447eb3c08fe903b

  • SSDEEP

    12288:mSP2Vu2On5XQlE983JNsUDvlkd73hS3n8H5PGFAyG/Q7wvT:x/2On5XakphS305P4An/97

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2055228256697d8e6c5630360340e9199afb2afe92e34fce28a65fb4043ecdb5.exe
    "C:\Users\Admin\AppData\Local\Temp\2055228256697d8e6c5630360340e9199afb2afe92e34fce28a65fb4043ecdb5.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\dfs849B.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • \Users\Admin\AppData\Local\Temp\dfs849B.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • memory/1684-56-0x0000000000310000-0x000000000039C000-memory.dmp

    Filesize

    560KB

  • memory/1684-57-0x00000000003A0000-0x00000000003AC000-memory.dmp

    Filesize

    48KB

  • memory/1684-58-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

    Filesize

    8KB

  • memory/1684-59-0x0000000004DB7000-0x0000000004DC8000-memory.dmp

    Filesize

    68KB

  • memory/1684-60-0x000000000A610000-0x000000000ADB6000-memory.dmp

    Filesize

    7.6MB