Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    82s
  • max time network
    89s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 18:49

General

  • Target

    edfdbb51b924bc503979764a107a6b21.exe

  • Size

    1.3MB

  • MD5

    edfdbb51b924bc503979764a107a6b21

  • SHA1

    d5aee7e8fa1c8409df3f8680bd0838e340b02919

  • SHA256

    299f163bfa323164ca2db712eb788d8b71f7c1b7197aed20e23409368f5d9eed

  • SHA512

    0f6a429fe18337890e8445e43bc826c428af256d2691a72701a4a8e4f943943d25b2dcc3ed36a3fd10ffcc8f1609dd1fec3045527c9ee6d118138ec1386aee4d

  • SSDEEP

    24576:KWkI3RbidB+WwCUENepvtCKxGqSMntHnaoyKmQrLL/7hZSqpzyn1IvQqFRM:KZXOWw3XpvcahRnbuQnL/CqpG13ORM

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 38 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edfdbb51b924bc503979764a107a6b21.exe
    "C:\Users\Admin\AppData\Local\Temp\edfdbb51b924bc503979764a107a6b21.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Windows\syswow64\rundll32.exe
      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
      2⤵
      • Blocklisted process makes network request
      PID:748
    • C:\Windows\syswow64\rundll32.exe
      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
      2⤵
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:808
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20409
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1700

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Wffwew.tmp

    Filesize

    3.5MB

    MD5

    a7d875022bb5e3a34d034b947003d1b3

    SHA1

    5905ca93fea101ce80e5bf8925eb2a7eec1e333d

    SHA256

    bcdf4c540c4289f81c98448d0a4482a96522fb767ab6015e76288afce148226a

    SHA512

    f2b78a100cf0fa84909629b892e548d7ef9797621623a96aa75f15241d7350eecca117c3793056c30dc317ade8ecc0023c2b875516d9c25ac9bb0d880bb3149a

  • memory/748-93-0x0000000000090000-0x0000000000093000-memory.dmp

    Filesize

    12KB

  • memory/748-91-0x0000000000090000-0x0000000000093000-memory.dmp

    Filesize

    12KB

  • memory/748-90-0x0000000000080000-0x0000000000083000-memory.dmp

    Filesize

    12KB

  • memory/748-94-0x0000000000090000-0x0000000000093000-memory.dmp

    Filesize

    12KB

  • memory/748-62-0x0000000000180000-0x0000000000183000-memory.dmp

    Filesize

    12KB

  • memory/748-60-0x0000000000180000-0x0000000000183000-memory.dmp

    Filesize

    12KB

  • memory/808-120-0x0000000002A90000-0x0000000002BD0000-memory.dmp

    Filesize

    1.2MB

  • memory/808-121-0x0000000002A90000-0x0000000002BD0000-memory.dmp

    Filesize

    1.2MB

  • memory/808-126-0x0000000002A90000-0x0000000002BD0000-memory.dmp

    Filesize

    1.2MB

  • memory/808-133-0x0000000002CB0000-0x0000000003810000-memory.dmp

    Filesize

    11.4MB

  • memory/808-122-0x0000000002A90000-0x0000000002BD0000-memory.dmp

    Filesize

    1.2MB

  • memory/808-125-0x0000000002A90000-0x0000000002BD0000-memory.dmp

    Filesize

    1.2MB

  • memory/808-109-0x0000000000930000-0x0000000001370000-memory.dmp

    Filesize

    10.2MB

  • memory/808-138-0x0000000002CB0000-0x0000000003810000-memory.dmp

    Filesize

    11.4MB

  • memory/808-119-0x0000000002A90000-0x0000000002BD0000-memory.dmp

    Filesize

    1.2MB

  • memory/808-127-0x0000000002A90000-0x0000000002BD0000-memory.dmp

    Filesize

    1.2MB

  • memory/808-118-0x0000000002A90000-0x0000000002BD0000-memory.dmp

    Filesize

    1.2MB

  • memory/808-117-0x0000000002CB0000-0x0000000003810000-memory.dmp

    Filesize

    11.4MB

  • memory/808-116-0x0000000002CB0000-0x0000000003810000-memory.dmp

    Filesize

    11.4MB

  • memory/808-115-0x0000000000930000-0x0000000001370000-memory.dmp

    Filesize

    10.2MB

  • memory/808-113-0x0000000002CB0000-0x0000000003810000-memory.dmp

    Filesize

    11.4MB

  • memory/1644-107-0x0000000004060000-0x00000000041A0000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-97-0x0000000002FA0000-0x0000000003B00000-memory.dmp

    Filesize

    11.4MB

  • memory/1644-108-0x0000000004060000-0x00000000041A0000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-106-0x0000000004060000-0x00000000041A0000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-102-0x0000000004060000-0x00000000041A0000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-103-0x0000000002FA0000-0x0000000003B00000-memory.dmp

    Filesize

    11.4MB

  • memory/1644-105-0x0000000004060000-0x00000000041A0000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-104-0x0000000004060000-0x00000000041A0000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-101-0x0000000004060000-0x00000000041A0000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-100-0x0000000004060000-0x00000000041A0000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-99-0x0000000002FA0000-0x0000000003B00000-memory.dmp

    Filesize

    11.4MB

  • memory/1644-58-0x00000000022C0000-0x000000000258C000-memory.dmp

    Filesize

    2.8MB

  • memory/1644-96-0x0000000002FA0000-0x0000000003B00000-memory.dmp

    Filesize

    11.4MB

  • memory/1644-92-0x0000000000400000-0x0000000000958000-memory.dmp

    Filesize

    5.3MB

  • memory/1644-55-0x0000000000960000-0x0000000000A82000-memory.dmp

    Filesize

    1.1MB

  • memory/1644-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

    Filesize

    8KB

  • memory/1644-59-0x0000000000400000-0x0000000000958000-memory.dmp

    Filesize

    5.3MB

  • memory/1644-56-0x0000000000400000-0x0000000000958000-memory.dmp

    Filesize

    5.3MB

  • memory/1644-57-0x0000000000960000-0x0000000000A82000-memory.dmp

    Filesize

    1.1MB

  • memory/1644-129-0x0000000000400000-0x0000000000958000-memory.dmp

    Filesize

    5.3MB

  • memory/1644-130-0x0000000002FA0000-0x0000000003B00000-memory.dmp

    Filesize

    11.4MB

  • memory/1700-132-0x0000000001E40000-0x00000000020F2000-memory.dmp

    Filesize

    2.7MB

  • memory/1700-131-0x0000000000210000-0x00000000004B0000-memory.dmp

    Filesize

    2.6MB

  • memory/1700-134-0x0000000002100000-0x0000000002240000-memory.dmp

    Filesize

    1.2MB

  • memory/1700-135-0x0000000002100000-0x0000000002240000-memory.dmp

    Filesize

    1.2MB

  • memory/1700-136-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

    Filesize

    8KB

  • memory/1700-137-0x0000000001E40000-0x00000000020F2000-memory.dmp

    Filesize

    2.7MB

  • memory/1700-123-0x0000000000210000-0x00000000004B0000-memory.dmp

    Filesize

    2.6MB

  • memory/1700-139-0x0000000001E40000-0x00000000020F2000-memory.dmp

    Filesize

    2.7MB