Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
176s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
25/11/2022, 15:11
General
-
Target
2ddcb51962bfd990f021e3a03347b363778daf20951a14667ec658ef013bbaa5.exe
-
Size
540KB
-
MD5
466606b22ec6b4d8ddc0916cdd1b7fcb
-
SHA1
9e5180f41d226abb2f9f4f05abd39b89ea1531b9
-
SHA256
2ddcb51962bfd990f021e3a03347b363778daf20951a14667ec658ef013bbaa5
-
SHA512
2ad23c61d8f035f00dbf205530cdd9de1b183045d6717e9bc7f8e1441ba0f40ffd67edd9f50bcaac06e55b557c0fbae77c04db8039fc7ee854a72513dbf02291
-
SSDEEP
12288:+f8w94y9NpM38r6ArJ8OIqYJY2xzuLnqWk21/g5x:fwRTcW6ArJ8zqYenqWkR5x
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ddcb51962bfd990f021e3a03347b363778daf20951a14667ec658ef013bbaa5.exe"C:\Users\Admin\AppData\Local\Temp\2ddcb51962bfd990f021e3a03347b363778daf20951a14667ec658ef013bbaa5.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx