Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe
Resource
win10v2004-20221111-en
General
-
Target
ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe
-
Size
315KB
-
MD5
3aa833cea94a13a4e31742bdd6c436aa
-
SHA1
323bf973dd5e45ca181e8c57f276301c0415c6a2
-
SHA256
ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2
-
SHA512
5906da08f9c91ffd2bc2f955de04a003477e85e80326b651ae11214e61ad19d8f88d0137e10a372b2b655a808248cc9ec746979514dfe04a43c6be518e2aaad0
-
SSDEEP
6144:srcbUzkuvcBYC47l2x6VhrsvjcGUk6u2EOhB6nzuY5+l:srhkuveY3bGkz6zuY54
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 1300 ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe 1300 ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe 1300 ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1300 ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe"C:\Users\Admin\AppData\Local\Temp\ac0b21c7cd50b4240954fcdef81c3259d10bece3fea11848ed140972af7921d2.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1300
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
91KB
MD52580b4f2c4522fe5cb36e6d3ec09b24a
SHA139bbe49606478a8d9abcdeca1e84040b4411f219
SHA2567b89020c401d0b5dd46aea117303ec67392eb295555dbfd26ac3beef8417eb00
SHA512eb2c377bcfdc3e9f587e0262c109856abbb07cb9ce3b28d9ec37f0862a611823ea5c856ead54afef0817162e72c51540da053bf4453039d0977f8fdd1050f413
-
Filesize
173KB
MD59b02f9d7afb338368b1aab73f21708cd
SHA1a0388f5f972226beea6f6a030deca269d3ffe2dd
SHA2562fda616670264c4cc03f1ce8420dfcc79b79920e836737f6cee360d51413805f
SHA5126381df05f90e9fe07e35c53f7f601ddb74f42988140ca6af075a3edd60282f5620250cd9e86c3a5b04fef2ce4b6cf7971773fdf5a416c271b4381a788dd453e4