Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 11:10
Behavioral task
behavioral1
Sample
ad243363aff51785f31724baea1175d470d5ac6e4a77c4a649065644cd07723d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ad243363aff51785f31724baea1175d470d5ac6e4a77c4a649065644cd07723d.exe
Resource
win10v2004-20220812-en
General
-
Target
ad243363aff51785f31724baea1175d470d5ac6e4a77c4a649065644cd07723d.exe
-
Size
119KB
-
MD5
1604ecf48fa3952cbe0a0ee5fd68fb72
-
SHA1
254ff5493b991819ef1d0c1fa402b9bb5ee5003f
-
SHA256
ad243363aff51785f31724baea1175d470d5ac6e4a77c4a649065644cd07723d
-
SHA512
905d7327bec0a46884427a9c5f747a8271fc464c55bcb03e7209c10502ae28ea8f52dd0a35ad3050fa12fa45f97e7149d535049e274ea7fc151b2e3808818577
-
SSDEEP
3072:bP2zZJa3CpKtdUbfr75SL0DnsOvwHDNTI95/v5LMM:bP2zZnidYfr7ogwJHDJi59
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winupdate.exe ad243363aff51785f31724baea1175d470d5ac6e4a77c4a649065644cd07723d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winupdate.exe ad243363aff51785f31724baea1175d470d5ac6e4a77c4a649065644cd07723d.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf ad243363aff51785f31724baea1175d470d5ac6e4a77c4a649065644cd07723d.exe File opened for modification C:\autorun.inf ad243363aff51785f31724baea1175d470d5ac6e4a77c4a649065644cd07723d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.