Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 12:04
Behavioral task
behavioral1
Sample
c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
Resource
win10v2004-20220812-en
General
-
Target
c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
-
Size
1014KB
-
MD5
93ec591bcd108f1e21d5426348295410
-
SHA1
f9eb7085bf72b5dab61eeaed832975ff51a24c9c
-
SHA256
c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d
-
SHA512
9a304354967eb0baf90cbb638d1c64d4f7f72111b15d9ada556822bc0ce8eee0b50310ccdb65011c4a075496eb00ac4eb1b65f45c9ca7f325fa5e2515223150a
-
SSDEEP
24576:y969NTTlWa8vuj18D384lX6sGkbQLmIQoTDYbu4sH+D:y96nTJWasuj18DMARrQLmIQyL4sH+
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x000c0000000054a8-59.dat aspack_v212_v242 behavioral1/files/0x000c0000000054a8-61.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1892 bRC.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe -
Loads dropped DLL 1 IoCs
pid Process 968 c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 968 c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 968 wrote to memory of 1892 968 c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe 28 PID 968 wrote to memory of 1892 968 c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe 28 PID 968 wrote to memory of 1892 968 c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe 28 PID 968 wrote to memory of 1892 968 c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe"C:\Users\Admin\AppData\Local\Temp\c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe"2⤵
- Executes dropped EXE
PID:1892
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1014KB
MD593ec591bcd108f1e21d5426348295410
SHA1f9eb7085bf72b5dab61eeaed832975ff51a24c9c
SHA256c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d
SHA5129a304354967eb0baf90cbb638d1c64d4f7f72111b15d9ada556822bc0ce8eee0b50310ccdb65011c4a075496eb00ac4eb1b65f45c9ca7f325fa5e2515223150a
-
Filesize
1014KB
MD593ec591bcd108f1e21d5426348295410
SHA1f9eb7085bf72b5dab61eeaed832975ff51a24c9c
SHA256c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d
SHA5129a304354967eb0baf90cbb638d1c64d4f7f72111b15d9ada556822bc0ce8eee0b50310ccdb65011c4a075496eb00ac4eb1b65f45c9ca7f325fa5e2515223150a