Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win10v2004-20220812-en
General
-
Target
Trojan-Ransom.Win32.Blocker.exe
-
Size
191KB
-
MD5
dca30ed8ed2e1b0cd9e33d5a5f069d41
-
SHA1
aed616497015c68305b45d5914125456266d8a56
-
SHA256
a1397e04e67079d8efba3da04abed1cefb81a819f7c0d5bc9083f10605301e8e
-
SHA512
6a7b6f3480bdc694d764cda9dfae1763490dbd309af508df582e2a9860eafa6b932681342ee7a7537204265cceaa0ea69188afc8d7559035a2c2f7f92555e1e9
-
SSDEEP
3072:tJ1eo3Qj+8NhvDtQiJNXs3vXCT8uzl8PcRZzFPk2I111KYiI1Uk1g:kg8Nds3vSTHlJHMziy1
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\11240 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mspocuiv.scr" svchost.exe -
Executes dropped EXE 3 IoCs
pid Process 676 fixmapi.exe 240 wdmaud.exe 2012 fixmapi.exe -
Loads dropped DLL 2 IoCs
pid Process 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce fixmapi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FIXMAPI 1.0 MAPI Repair Tool = "C:\\Users\\Admin\\Music\\fixmapi.exe" fixmapi.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce fixmapi.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FIXMAPI 1.0 MAPI Repair Tool = "C:\\Users\\Admin\\Music\\fixmapi.exe" fixmapi.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum AppLaunch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum AppLaunch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 AppLaunch.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1544 set thread context of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 240 set thread context of 1772 240 wdmaud.exe 31 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\mspocuiv.scr svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\MICROS~1.NET\FRAMEW~1\V20~1.507\AppLaunch.exe svchost.exe File opened for modification C:\Windows\MICROS~1.NET\FRAMEW~1\V20~1.507\AppLaunch.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1544 Trojan-Ransom.Win32.Blocker.exe 896 AppLaunch.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe 1544 Trojan-Ransom.Win32.Blocker.exe 676 fixmapi.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 896 AppLaunch.exe 896 AppLaunch.exe 1772 AppLaunch.exe 1772 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1544 Trojan-Ransom.Win32.Blocker.exe Token: SeDebugPrivilege 676 fixmapi.exe Token: SeDebugPrivilege 240 wdmaud.exe Token: SeDebugPrivilege 2012 fixmapi.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 896 1544 Trojan-Ransom.Win32.Blocker.exe 26 PID 1544 wrote to memory of 676 1544 Trojan-Ransom.Win32.Blocker.exe 28 PID 1544 wrote to memory of 676 1544 Trojan-Ransom.Win32.Blocker.exe 28 PID 1544 wrote to memory of 676 1544 Trojan-Ransom.Win32.Blocker.exe 28 PID 1544 wrote to memory of 676 1544 Trojan-Ransom.Win32.Blocker.exe 28 PID 896 wrote to memory of 592 896 AppLaunch.exe 27 PID 896 wrote to memory of 592 896 AppLaunch.exe 27 PID 896 wrote to memory of 592 896 AppLaunch.exe 27 PID 896 wrote to memory of 592 896 AppLaunch.exe 27 PID 896 wrote to memory of 592 896 AppLaunch.exe 27 PID 896 wrote to memory of 592 896 AppLaunch.exe 27 PID 896 wrote to memory of 592 896 AppLaunch.exe 27 PID 676 wrote to memory of 240 676 fixmapi.exe 29 PID 676 wrote to memory of 240 676 fixmapi.exe 29 PID 676 wrote to memory of 240 676 fixmapi.exe 29 PID 676 wrote to memory of 240 676 fixmapi.exe 29 PID 1544 wrote to memory of 2012 1544 Trojan-Ransom.Win32.Blocker.exe 30 PID 1544 wrote to memory of 2012 1544 Trojan-Ransom.Win32.Blocker.exe 30 PID 1544 wrote to memory of 2012 1544 Trojan-Ransom.Win32.Blocker.exe 30 PID 1544 wrote to memory of 2012 1544 Trojan-Ransom.Win32.Blocker.exe 30 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 240 wrote to memory of 1772 240 wdmaud.exe 31 PID 1772 wrote to memory of 344 1772 AppLaunch.exe 32 PID 1772 wrote to memory of 344 1772 AppLaunch.exe 32 PID 1772 wrote to memory of 344 1772 AppLaunch.exe 32 PID 1772 wrote to memory of 344 1772 AppLaunch.exe 32 PID 1772 wrote to memory of 344 1772 AppLaunch.exe 32 PID 1772 wrote to memory of 344 1772 AppLaunch.exe 32 PID 1772 wrote to memory of 344 1772 AppLaunch.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
PID:592
-
-
-
C:\Users\Admin\Music\fixmapi.exe"C:\Users\Admin\Music\fixmapi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\Music\wdmaud.exe"C:\Users\Admin\Music\wdmaud.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"4⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe5⤵
- Drops file in Windows directory
PID:344
-
-
-
-
-
C:\Users\Admin\Music\fixmapi.exe"C:\Users\Admin\Music\fixmapi.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD54ec62b0699655eb20fd214eec15c51ab
SHA1f6cfe1fa8e24075108a366b4221363a237d49612
SHA256188458191d34e71ba6c626cab667ea82c6e2bad7f4c42303be19b97aaf7e84d5
SHA512041191306ac832856b39731cd0f3730b6b8a16eb79d389b2886232371d304e58f8a6a07aee73ad9ad35f079f3838fe3507ad1f7355ca034a504edcffc29fb329
-
Filesize
16KB
MD54ec62b0699655eb20fd214eec15c51ab
SHA1f6cfe1fa8e24075108a366b4221363a237d49612
SHA256188458191d34e71ba6c626cab667ea82c6e2bad7f4c42303be19b97aaf7e84d5
SHA512041191306ac832856b39731cd0f3730b6b8a16eb79d389b2886232371d304e58f8a6a07aee73ad9ad35f079f3838fe3507ad1f7355ca034a504edcffc29fb329
-
Filesize
16KB
MD54ec62b0699655eb20fd214eec15c51ab
SHA1f6cfe1fa8e24075108a366b4221363a237d49612
SHA256188458191d34e71ba6c626cab667ea82c6e2bad7f4c42303be19b97aaf7e84d5
SHA512041191306ac832856b39731cd0f3730b6b8a16eb79d389b2886232371d304e58f8a6a07aee73ad9ad35f079f3838fe3507ad1f7355ca034a504edcffc29fb329
-
Filesize
191KB
MD5dca30ed8ed2e1b0cd9e33d5a5f069d41
SHA1aed616497015c68305b45d5914125456266d8a56
SHA256a1397e04e67079d8efba3da04abed1cefb81a819f7c0d5bc9083f10605301e8e
SHA5126a7b6f3480bdc694d764cda9dfae1763490dbd309af508df582e2a9860eafa6b932681342ee7a7537204265cceaa0ea69188afc8d7559035a2c2f7f92555e1e9
-
Filesize
191KB
MD5dca30ed8ed2e1b0cd9e33d5a5f069d41
SHA1aed616497015c68305b45d5914125456266d8a56
SHA256a1397e04e67079d8efba3da04abed1cefb81a819f7c0d5bc9083f10605301e8e
SHA5126a7b6f3480bdc694d764cda9dfae1763490dbd309af508df582e2a9860eafa6b932681342ee7a7537204265cceaa0ea69188afc8d7559035a2c2f7f92555e1e9
-
Filesize
16KB
MD54ec62b0699655eb20fd214eec15c51ab
SHA1f6cfe1fa8e24075108a366b4221363a237d49612
SHA256188458191d34e71ba6c626cab667ea82c6e2bad7f4c42303be19b97aaf7e84d5
SHA512041191306ac832856b39731cd0f3730b6b8a16eb79d389b2886232371d304e58f8a6a07aee73ad9ad35f079f3838fe3507ad1f7355ca034a504edcffc29fb329
-
Filesize
191KB
MD5dca30ed8ed2e1b0cd9e33d5a5f069d41
SHA1aed616497015c68305b45d5914125456266d8a56
SHA256a1397e04e67079d8efba3da04abed1cefb81a819f7c0d5bc9083f10605301e8e
SHA5126a7b6f3480bdc694d764cda9dfae1763490dbd309af508df582e2a9860eafa6b932681342ee7a7537204265cceaa0ea69188afc8d7559035a2c2f7f92555e1e9