Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe
Resource
win10v2004-20220901-en
General
-
Target
29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe
-
Size
782KB
-
MD5
84dbc46edb754d7c7bef4dbc3ffcfda0
-
SHA1
21f024aed6a44e2c32dfc09f8e9da8e71d84583e
-
SHA256
29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f
-
SHA512
78dc3f2d398a13ff5a3284b6c062fa384af61261f7694e0fe8ac43bf5f04d9b479df5d425d5ee17fa47c64668c0644015419b14c4d774016e50d549d06618e9b
-
SSDEEP
12288:JnvpwYOmisC6GKvirLLkaIOAjz7VePLCVCuHI10DT9BxPmUl7MXCByoah/fa:Jnv+fSCFcmSzR2LmU0/9H5+ShahK
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/748-57-0x0000000000960000-0x0000000000AD2000-memory.dmp upx behavioral1/memory/748-60-0x0000000000960000-0x0000000000AD2000-memory.dmp upx behavioral1/memory/748-61-0x0000000000960000-0x0000000000AD2000-memory.dmp upx behavioral1/memory/748-62-0x0000000000960000-0x0000000000AD2000-memory.dmp upx behavioral1/memory/324-65-0x0000000001D60000-0x0000000001ED2000-memory.dmp upx behavioral1/memory/324-68-0x0000000001D60000-0x0000000001ED2000-memory.dmp upx behavioral1/memory/324-69-0x0000000001D60000-0x0000000001ED2000-memory.dmp upx behavioral1/memory/324-70-0x0000000001D60000-0x0000000001ED2000-memory.dmp upx behavioral1/memory/324-71-0x0000000001D60000-0x0000000001ED2000-memory.dmp upx behavioral1/memory/748-72-0x0000000000960000-0x0000000000AD2000-memory.dmp upx behavioral1/memory/324-73-0x0000000001D60000-0x0000000001ED2000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~2\is7166405.log 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 748 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe 748 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 748 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 748 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe 748 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 748 wrote to memory of 324 748 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe 27 PID 748 wrote to memory of 324 748 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe 27 PID 748 wrote to memory of 324 748 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe 27 PID 748 wrote to memory of 324 748 29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe"C:\Users\Admin\AppData\Local\Temp\29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe"1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe"C:\Users\Admin\AppData\Local\Temp\29400a5c753bbc10b648dcd0efcfc7cc7920478cbb51a284c58f5d5e4468781f.exe" /_ShowProgress2⤵PID:324
-