Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 18:03

General

  • Target

    d010b81c3702cd3811c07f8815c0d7025f382a5bb613da99fe51a3e732fb7651.exe

  • Size

    85KB

  • MD5

    5179e8ffb2edf34e1873fbb69799e6e0

  • SHA1

    fe89097c277a3c3eec8c8abe644b650e46ba7b83

  • SHA256

    d010b81c3702cd3811c07f8815c0d7025f382a5bb613da99fe51a3e732fb7651

  • SHA512

    226967f281e5b6d1d462d371a8685801441eec06b741ffe8e9b955134610f709bfdb3514b1d0cc2975d7d5970b337d0de89dbb6ccb489bb2a90f4fed2be20fed

  • SSDEEP

    768:zdlo/TaYmBcU7BPCHpT1PY9DRxXMX6PNrZSaLAXJpG87ZkDJZ+TyhCMijwRPtvy2:zdoTsBr6s72iNrouMkA7MsaN

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    FADP100899

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d010b81c3702cd3811c07f8815c0d7025f382a5bb613da99fe51a3e732fb7651.exe
    "C:\Users\Admin\AppData\Local\Temp\d010b81c3702cd3811c07f8815c0d7025f382a5bb613da99fe51a3e732fb7651.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\REMOVELAPR.exe
      "C:\Users\Admin\AppData\Local\Temp\REMOVELAPR.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2040

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\REMOVELAPR.exe

    Filesize

    52KB

    MD5

    d5d911367ea78e362cab65c5357b24dc

    SHA1

    1d307cc49e4b1bea18f418a590c98d60bd0e133d

    SHA256

    c620cfc8140f7c166ee9e736969bd9cbc185b30af1d72f5b690d29003e14b3b0

    SHA512

    327e34f75f21ff5362501e61e14f11b7b4d1d4375fabe82b722911a2fc973a7bc076a376a7fb24106b1ce2f4cef246bbdfd1b8ffa6daab5345f9ac612a1b8416

  • C:\Users\Admin\AppData\Local\Temp\REMOVELAPR.exe

    Filesize

    52KB

    MD5

    d5d911367ea78e362cab65c5357b24dc

    SHA1

    1d307cc49e4b1bea18f418a590c98d60bd0e133d

    SHA256

    c620cfc8140f7c166ee9e736969bd9cbc185b30af1d72f5b690d29003e14b3b0

    SHA512

    327e34f75f21ff5362501e61e14f11b7b4d1d4375fabe82b722911a2fc973a7bc076a376a7fb24106b1ce2f4cef246bbdfd1b8ffa6daab5345f9ac612a1b8416

  • memory/1668-54-0x000007FEF4130000-0x000007FEF4B53000-memory.dmp

    Filesize

    10.1MB

  • memory/1668-55-0x000007FEF3090000-0x000007FEF4126000-memory.dmp

    Filesize

    16.6MB

  • memory/1668-56-0x0000000000906000-0x0000000000925000-memory.dmp

    Filesize

    124KB

  • memory/1668-60-0x0000000000906000-0x0000000000925000-memory.dmp

    Filesize

    124KB

  • memory/2040-61-0x000007FEF4130000-0x000007FEF4B53000-memory.dmp

    Filesize

    10.1MB

  • memory/2040-62-0x000007FEEEC00000-0x000007FEEFC96000-memory.dmp

    Filesize

    16.6MB