Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/11/2022, 18:40
Behavioral task
behavioral1
Sample
7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe
-
Size
176KB
-
MD5
56ca8efd6d41dd310abc232365624d07
-
SHA1
706ec20c8303299217135d381ad3d0631f3aef52
-
SHA256
7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a
-
SHA512
e88b05ef3b8cbde54994d8000e28d069c5a24d6345cda6a6fd5f79e1702ed68fe6c4450c290bc9065cdcff3ca18b19e60e425688539a77c7712bc73bf150969b
-
SSDEEP
3072:O/Vr9auMqqDL2/xr3IdE8we0Avu5r++ygLIaaxvdy0X9v/7M7BC/FTqdVY77C37R:O/VYFqqDL68vdy0tv
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 41 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 Destination IP 43.135.105.134 -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\O: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\P: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\U: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\Z: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\H: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\K: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\F: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\G: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\J: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\M: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\N: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\S: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\B: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\E: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\Y: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\L: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\Q: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\R: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\T: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\V: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\W: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\A: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe File opened (read-only) \??\I: 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1368 wrote to memory of 624 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 28 PID 1368 wrote to memory of 624 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 28 PID 1368 wrote to memory of 624 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 28 PID 1368 wrote to memory of 624 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 28 PID 1368 wrote to memory of 1916 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 31 PID 1368 wrote to memory of 1916 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 31 PID 1368 wrote to memory of 1916 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 31 PID 1368 wrote to memory of 1916 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 31 PID 1368 wrote to memory of 1556 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 33 PID 1368 wrote to memory of 1556 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 33 PID 1368 wrote to memory of 1556 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 33 PID 1368 wrote to memory of 1556 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 33 PID 1368 wrote to memory of 1188 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 35 PID 1368 wrote to memory of 1188 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 35 PID 1368 wrote to memory of 1188 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 35 PID 1368 wrote to memory of 1188 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 35 PID 1368 wrote to memory of 1672 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 37 PID 1368 wrote to memory of 1672 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 37 PID 1368 wrote to memory of 1672 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 37 PID 1368 wrote to memory of 1672 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 37 PID 1368 wrote to memory of 1908 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 39 PID 1368 wrote to memory of 1908 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 39 PID 1368 wrote to memory of 1908 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 39 PID 1368 wrote to memory of 1908 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 39 PID 1368 wrote to memory of 1876 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 41 PID 1368 wrote to memory of 1876 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 41 PID 1368 wrote to memory of 1876 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 41 PID 1368 wrote to memory of 1876 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 41 PID 1368 wrote to memory of 972 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 43 PID 1368 wrote to memory of 972 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 43 PID 1368 wrote to memory of 972 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 43 PID 1368 wrote to memory of 972 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 43 PID 1368 wrote to memory of 1392 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 45 PID 1368 wrote to memory of 1392 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 45 PID 1368 wrote to memory of 1392 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 45 PID 1368 wrote to memory of 1392 1368 7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe"C:\Users\Admin\AppData\Local\Temp\7156d699688b36dbe9ec987a934d2e41fa6c48999b0b3b99b4f00598ca6f506a.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit a.dnspod.com2⤵PID:624
-
-
C:\Windows\SysWOW64\nslookup.exenslookup bleepingcomputer.bit a.dnspod.com2⤵PID:1916
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit a.dnspod.com2⤵PID:1556
-
-
C:\Windows\SysWOW64\nslookup.exenslookup esetnod32.bit a.dnspod.com2⤵PID:1188
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit a.dnspod.com2⤵PID:1672
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit a.dnspod.com2⤵PID:1908
-
-
C:\Windows\SysWOW64\nslookup.exenslookup bleepingcomputer.bit a.dnspod.com2⤵PID:1876
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit a.dnspod.com2⤵PID:972
-
-
C:\Windows\SysWOW64\nslookup.exenslookup esetnod32.bit a.dnspod.com2⤵PID:1392
-