Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe
Resource
win10v2004-20221111-en
General
-
Target
239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe
-
Size
1.5MB
-
MD5
cb4274cd1a76071e7abc516a4f411b5d
-
SHA1
767a949a1947347f150f0acca6a3d508e4890bca
-
SHA256
239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37
-
SHA512
b0e5b3b74c603c8fe19821b55ada4a2356816d4c5349c522cd1d0761f448d4b56f031ffb838af718fab616983327a4dee9e29bf6b3581d0b2baacc65c0ad1b8c
-
SSDEEP
24576:Hpa/O74CNt3r2J2FC3eUldZUJ3OlKU4UDcc6Cy+9eGH:wcZC35VcOcmDcc6Cd5
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1232 set thread context of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 568 PING.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1016 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 1016 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 1016 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 1016 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 1016 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1232 wrote to memory of 272 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 28 PID 1232 wrote to memory of 272 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 28 PID 1232 wrote to memory of 272 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 28 PID 1232 wrote to memory of 272 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 28 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 272 wrote to memory of 568 272 cmd.exe 31 PID 272 wrote to memory of 568 272 cmd.exe 31 PID 272 wrote to memory of 568 272 cmd.exe 31 PID 272 wrote to memory of 568 272 cmd.exe 31 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30 PID 1232 wrote to memory of 1016 1232 239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe"C:\Users\Admin\AppData\Local\Temp\239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -c 5 8.8.8.82⤵
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\SysWOW64\PING.EXEping -c 5 8.8.8.83⤵
- Runs ping.exe
PID:568
-
-
-
C:\Users\Admin\AppData\Local\Temp\239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe"C:\Users\Admin\AppData\Local\Temp\239a82bc7084c8a4e78f655be9b0df2cbfd714cba119253a625544ba2693ab37.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1016
-