Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe
Resource
win10v2004-20220812-en
General
-
Target
26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe
-
Size
30KB
-
MD5
933e59e6cb3c1343abb87d637cb99c60
-
SHA1
c414e1516af8d9054ef7e958e168cb4106c3fc83
-
SHA256
26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4
-
SHA512
5efb476eb73a8c958db467890e7dc9973dd23106995de2e1960a97064799cd9cabe9c2750a47695dcf815026cf4a693df6c27460c7403eb4fd4b39d075bdb6ce
-
SSDEEP
384:uE6/xRFH7AhD7+8lQxMO7U1VN+uXL7SkjkKqu3pLAY1a/9Tt:uE6/xLQq8lxO7juX/qKX3iOa/9Tt
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1332 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1520 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1520 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1760 26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1332 1760 26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe 29 PID 1760 wrote to memory of 1332 1760 26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe 29 PID 1760 wrote to memory of 1332 1760 26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe 29 PID 1760 wrote to memory of 1332 1760 26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe 29 PID 1332 wrote to memory of 1520 1332 cmd.exe 31 PID 1332 wrote to memory of 1520 1332 cmd.exe 31 PID 1332 wrote to memory of 1520 1332 cmd.exe 31 PID 1332 wrote to memory of 1520 1332 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe"C:\Users\Admin\AppData\Local\Temp\26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 26af4e489705ce9f33b1393323e7750c075045b5a9c8b15dd21d2a0462800fe4.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-