Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    37s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 16:25

General

  • Target

    b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe

  • Size

    540KB

  • MD5

    836889f1844bcc4b0d45c076dddc9e60

  • SHA1

    43f5db0eec96f26fcce318bdaa387cf97e608efe

  • SHA256

    b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a

  • SHA512

    f5182fca19a41b66e6f39cff41ca2c2434d6f2ae6152344e1b0864b3a098a6966c602ad9e8e813bd01f88dacd63bccd1b59bd4d859934ac16c3854390e1f54e5

  • SSDEEP

    12288:S9XdVx1+9jsFIezPTWuljbv95k92tVpg3:a/EjsFI0Fd9A2tVpo

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe
    "C:\Users\Admin\AppData\Local\Temp\b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\DelTemp.bat" "
      2⤵
      • Deletes itself
      PID:1980

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DelTemp.bat

    Filesize

    187B

    MD5

    a937df466bb1cec01b78b85f7d750306

    SHA1

    a486c28051ace0e133a3210dea5de480ed931257

    SHA256

    cfbf50625c150e395e83ff255c37369909b9f5aadc573f7c09e7466206bc4a0a

    SHA512

    4b767925755688b42e6ccb5dfcf144351c8dc837da9b88bdb7b70790865cc3e9227cef9940d71fde2b8a6eacf50e0befcc72f085bea275424ee106ab1add8786

  • memory/1672-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

    Filesize

    8KB