Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
30/10/2022, 21:24
General
-
Target
8ea0104200c54d3b95cb9b0ba02c591f6a9715a15965f687a132c05f763274f4.exe
-
Size
276KB
-
MD5
912d802e210eb92575f5b15d9a99c36c
-
SHA1
772eaed99ce1b61b960f6febf01649e20da4b97c
-
SHA256
8ea0104200c54d3b95cb9b0ba02c591f6a9715a15965f687a132c05f763274f4
-
SHA512
42876f82029c65fe0e443d7431500762c5c30e8c0c2a8cd2dd9d8ff8fff25ad3eb03ad1de83463b506d1a5d3971a7469fa3e0464c8f78734338a2be44c1eb446
-
SSDEEP
1536:C1cu8WexAS6XmKvhIMfoJUhSU6nPlTggJ2oj71BgR/Vp8dY1J7iS9KcNjkhWh1Hl:CrZ3lhzslTZJ9j7Heb8C1JCcFrhx+K
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 34 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ea0104200c54d3b95cb9b0ba02c591f6a9715a15965f687a132c05f763274f4.exe"C:\Users\Admin\AppData\Local\Temp\8ea0104200c54d3b95cb9b0ba02c591f6a9715a15965f687a132c05f763274f4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\eventvwr.msc" "C:\Windows\system32\eventvwr.msc"3⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
10.1MB
-
Filesize
16.6MB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
8KB
-
Filesize
124KB