Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/11/2022, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe
Resource
win10v2004-20220812-en
General
-
Target
a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe
-
Size
232KB
-
MD5
aa001872e37dfa8d0f00bef6ad4e73c7
-
SHA1
879418032f98d1fce502472a97d7d21c840388c5
-
SHA256
a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461
-
SHA512
444bcdb29f6b67f4f4bac55f655d395002e6149c577bde5208e950979a78fd3aa7464d188d034c6ef8e9f6abdfdd80de46b55a8059d4c4ae30184f6e89414646
-
SSDEEP
6144:KME1nmg1tDbJ5621YNAUvAXiXdee4Q/flRX9MJy1W3NLqpMgK:LgnJqLXdee4GvX9XQdLmA
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1744 RuijieSupplicant.exe 1328 8021x.exe -
Loads dropped DLL 13 IoCs
pid Process 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe 1744 RuijieSupplicant.exe 1744 RuijieSupplicant.exe 1744 RuijieSupplicant.exe 1744 RuijieSupplicant.exe 1744 RuijieSupplicant.exe 1744 RuijieSupplicant.exe 1744 RuijieSupplicant.exe 1328 8021x.exe 1328 8021x.exe 1328 8021x.exe 1328 8021x.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe Token: SeBackupPrivilege 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1744 RuijieSupplicant.exe 1328 8021x.exe 1328 8021x.exe 1328 8021x.exe 1328 8021x.exe 1328 8021x.exe 1328 8021x.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1744 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe 28 PID 1996 wrote to memory of 1744 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe 28 PID 1996 wrote to memory of 1744 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe 28 PID 1996 wrote to memory of 1744 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe 28 PID 1996 wrote to memory of 1744 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe 28 PID 1996 wrote to memory of 1744 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe 28 PID 1996 wrote to memory of 1744 1996 a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe 28 PID 1744 wrote to memory of 1328 1744 RuijieSupplicant.exe 29 PID 1744 wrote to memory of 1328 1744 RuijieSupplicant.exe 29 PID 1744 wrote to memory of 1328 1744 RuijieSupplicant.exe 29 PID 1744 wrote to memory of 1328 1744 RuijieSupplicant.exe 29 PID 1744 wrote to memory of 1328 1744 RuijieSupplicant.exe 29 PID 1744 wrote to memory of 1328 1744 RuijieSupplicant.exe 29 PID 1744 wrote to memory of 1328 1744 RuijieSupplicant.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe"C:\Users\Admin\AppData\Local\Temp\a4160313562563fe02a2c7ad5860e6be274785271359322697218e2c1fd97461.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\Ruijie\RuijieSupplicant.exe"C:\Users\Admin\AppData\Local\Temp\Ruijie\RuijieSupplicant.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\Ruijie\8021x.exe"C:\Users\Admin\AppData\Local\Temp\Ruijie\8021x.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1328
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5abfddc810c5ec70c614cbd101b6baa8a
SHA18411fdbc67aa8b62acfbf1852dac5c94b436c20c
SHA2562927b0d54c02ba90d68e61539d87f12339a338478fdbd111ae13e28c817677e2
SHA512dbb4537ab5a0c850b2683ca7708a120e211b916ff14ee2230033b33aa4032b9e93355d98c08fe8e365ce40fdb5333cee2ca0761f8120e7f63d5282710766581d
-
Filesize
180KB
MD5abfddc810c5ec70c614cbd101b6baa8a
SHA18411fdbc67aa8b62acfbf1852dac5c94b436c20c
SHA2562927b0d54c02ba90d68e61539d87f12339a338478fdbd111ae13e28c817677e2
SHA512dbb4537ab5a0c850b2683ca7708a120e211b916ff14ee2230033b33aa4032b9e93355d98c08fe8e365ce40fdb5333cee2ca0761f8120e7f63d5282710766581d
-
Filesize
24KB
MD59edff7cad88dc69b14f7f56ccd0a7a37
SHA155608b83bb6d7fe60ab0efac8390d3722ca93ef0
SHA256fb486e9c258c980f5d0b7e157c5fedfdbc3cd19287672a4b860b8beb2e6d53ed
SHA512bcdfab3bf799a4a96805e33db71911e5b3d138ad814faa8c9f84db112337e274de14b44db3d18e2e711cf92c640d7cea5c9913d1177d4dc21051d2d973ef20d5
-
Filesize
24KB
MD59edff7cad88dc69b14f7f56ccd0a7a37
SHA155608b83bb6d7fe60ab0efac8390d3722ca93ef0
SHA256fb486e9c258c980f5d0b7e157c5fedfdbc3cd19287672a4b860b8beb2e6d53ed
SHA512bcdfab3bf799a4a96805e33db71911e5b3d138ad814faa8c9f84db112337e274de14b44db3d18e2e711cf92c640d7cea5c9913d1177d4dc21051d2d973ef20d5
-
Filesize
284B
MD5b488fb078dd50cacfce68e6da3dd7705
SHA16f38cd606a347d219e234516c2a3998f3738a7b5
SHA2569cf3a101c35061eed47f1d8b422f95343949707dc1c23c4ec431507cfa70e5bf
SHA51253dc7206316235588377ddd9ec4486b7af5c61e22a92d514c04ef61d5f6a511120f31e7c69869ba67079a41ca0ada911cd1e3b0578e577ebaf5676e3fcfb3b99
-
Filesize
60KB
MD5f3c722f1a5372e4c9b7e76d76619a3a0
SHA19217c2ed4669a7a9fa95bf766a9a403f20f371b9
SHA256138029e51ea902db57770aba6d166baabb81459a35edc673e497350154426f4e
SHA512162b63428fd027958ff661e4be2e2909c2e8ade30a3c1ba33b1b57b5edf975fb1455d5a9709f90aef014fcf472f28fa70c827e13cc565f5da5f9365787498459
-
Filesize
2KB
MD5b051a7b25572c6556629ec35ce018d61
SHA1fedf049910a1e17c164e8018b4452838937327e2
SHA25666a85067c732f22dfeafeb016844d565f6dd47171bc7a0283009ca13be74e833
SHA512376afa843f008a742468c3694280e69390e14ef11d9b527053fced93e58b6afd9a8513e54e65a422f087a5d711618ef7ad62638dd91fca0c00ccfc628c78e3f9
-
Filesize
180KB
MD5abfddc810c5ec70c614cbd101b6baa8a
SHA18411fdbc67aa8b62acfbf1852dac5c94b436c20c
SHA2562927b0d54c02ba90d68e61539d87f12339a338478fdbd111ae13e28c817677e2
SHA512dbb4537ab5a0c850b2683ca7708a120e211b916ff14ee2230033b33aa4032b9e93355d98c08fe8e365ce40fdb5333cee2ca0761f8120e7f63d5282710766581d
-
Filesize
180KB
MD5abfddc810c5ec70c614cbd101b6baa8a
SHA18411fdbc67aa8b62acfbf1852dac5c94b436c20c
SHA2562927b0d54c02ba90d68e61539d87f12339a338478fdbd111ae13e28c817677e2
SHA512dbb4537ab5a0c850b2683ca7708a120e211b916ff14ee2230033b33aa4032b9e93355d98c08fe8e365ce40fdb5333cee2ca0761f8120e7f63d5282710766581d
-
Filesize
180KB
MD5abfddc810c5ec70c614cbd101b6baa8a
SHA18411fdbc67aa8b62acfbf1852dac5c94b436c20c
SHA2562927b0d54c02ba90d68e61539d87f12339a338478fdbd111ae13e28c817677e2
SHA512dbb4537ab5a0c850b2683ca7708a120e211b916ff14ee2230033b33aa4032b9e93355d98c08fe8e365ce40fdb5333cee2ca0761f8120e7f63d5282710766581d
-
Filesize
180KB
MD5abfddc810c5ec70c614cbd101b6baa8a
SHA18411fdbc67aa8b62acfbf1852dac5c94b436c20c
SHA2562927b0d54c02ba90d68e61539d87f12339a338478fdbd111ae13e28c817677e2
SHA512dbb4537ab5a0c850b2683ca7708a120e211b916ff14ee2230033b33aa4032b9e93355d98c08fe8e365ce40fdb5333cee2ca0761f8120e7f63d5282710766581d
-
Filesize
180KB
MD5abfddc810c5ec70c614cbd101b6baa8a
SHA18411fdbc67aa8b62acfbf1852dac5c94b436c20c
SHA2562927b0d54c02ba90d68e61539d87f12339a338478fdbd111ae13e28c817677e2
SHA512dbb4537ab5a0c850b2683ca7708a120e211b916ff14ee2230033b33aa4032b9e93355d98c08fe8e365ce40fdb5333cee2ca0761f8120e7f63d5282710766581d
-
Filesize
180KB
MD5abfddc810c5ec70c614cbd101b6baa8a
SHA18411fdbc67aa8b62acfbf1852dac5c94b436c20c
SHA2562927b0d54c02ba90d68e61539d87f12339a338478fdbd111ae13e28c817677e2
SHA512dbb4537ab5a0c850b2683ca7708a120e211b916ff14ee2230033b33aa4032b9e93355d98c08fe8e365ce40fdb5333cee2ca0761f8120e7f63d5282710766581d
-
Filesize
180KB
MD5abfddc810c5ec70c614cbd101b6baa8a
SHA18411fdbc67aa8b62acfbf1852dac5c94b436c20c
SHA2562927b0d54c02ba90d68e61539d87f12339a338478fdbd111ae13e28c817677e2
SHA512dbb4537ab5a0c850b2683ca7708a120e211b916ff14ee2230033b33aa4032b9e93355d98c08fe8e365ce40fdb5333cee2ca0761f8120e7f63d5282710766581d
-
Filesize
24KB
MD59edff7cad88dc69b14f7f56ccd0a7a37
SHA155608b83bb6d7fe60ab0efac8390d3722ca93ef0
SHA256fb486e9c258c980f5d0b7e157c5fedfdbc3cd19287672a4b860b8beb2e6d53ed
SHA512bcdfab3bf799a4a96805e33db71911e5b3d138ad814faa8c9f84db112337e274de14b44db3d18e2e711cf92c640d7cea5c9913d1177d4dc21051d2d973ef20d5
-
Filesize
24KB
MD59edff7cad88dc69b14f7f56ccd0a7a37
SHA155608b83bb6d7fe60ab0efac8390d3722ca93ef0
SHA256fb486e9c258c980f5d0b7e157c5fedfdbc3cd19287672a4b860b8beb2e6d53ed
SHA512bcdfab3bf799a4a96805e33db71911e5b3d138ad814faa8c9f84db112337e274de14b44db3d18e2e711cf92c640d7cea5c9913d1177d4dc21051d2d973ef20d5
-
Filesize
24KB
MD59edff7cad88dc69b14f7f56ccd0a7a37
SHA155608b83bb6d7fe60ab0efac8390d3722ca93ef0
SHA256fb486e9c258c980f5d0b7e157c5fedfdbc3cd19287672a4b860b8beb2e6d53ed
SHA512bcdfab3bf799a4a96805e33db71911e5b3d138ad814faa8c9f84db112337e274de14b44db3d18e2e711cf92c640d7cea5c9913d1177d4dc21051d2d973ef20d5
-
Filesize
24KB
MD59edff7cad88dc69b14f7f56ccd0a7a37
SHA155608b83bb6d7fe60ab0efac8390d3722ca93ef0
SHA256fb486e9c258c980f5d0b7e157c5fedfdbc3cd19287672a4b860b8beb2e6d53ed
SHA512bcdfab3bf799a4a96805e33db71911e5b3d138ad814faa8c9f84db112337e274de14b44db3d18e2e711cf92c640d7cea5c9913d1177d4dc21051d2d973ef20d5
-
Filesize
24KB
MD59edff7cad88dc69b14f7f56ccd0a7a37
SHA155608b83bb6d7fe60ab0efac8390d3722ca93ef0
SHA256fb486e9c258c980f5d0b7e157c5fedfdbc3cd19287672a4b860b8beb2e6d53ed
SHA512bcdfab3bf799a4a96805e33db71911e5b3d138ad814faa8c9f84db112337e274de14b44db3d18e2e711cf92c640d7cea5c9913d1177d4dc21051d2d973ef20d5
-
Filesize
60KB
MD5f3c722f1a5372e4c9b7e76d76619a3a0
SHA19217c2ed4669a7a9fa95bf766a9a403f20f371b9
SHA256138029e51ea902db57770aba6d166baabb81459a35edc673e497350154426f4e
SHA512162b63428fd027958ff661e4be2e2909c2e8ade30a3c1ba33b1b57b5edf975fb1455d5a9709f90aef014fcf472f28fa70c827e13cc565f5da5f9365787498459