Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 18:29
Static task
static1
Behavioral task
behavioral1
Sample
5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe
Resource
win10v2004-20220901-en
General
-
Target
5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe
-
Size
451KB
-
MD5
b0e2c156b901a5a87e947fea1ff56316
-
SHA1
dc3761398275dedca78517dcaa61e281eef1ca51
-
SHA256
5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e
-
SHA512
7a25c6b76be11c53748191849f236754947df0d14095f12319120cbbbcfc7dc655d544a85862dcd83f21db46971abd521897378c82cca86a51b43767935ca82d
-
SSDEEP
6144:SvaqS4IR/kviXzd4twM19AwCflNKBek0egb3CZF8/yoYZeiEzK4NKzLBM4cUvpSp:h/kviXzdtmJwNKBekM3GoYTEDeBf40bI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1892 hpigpwdrymrp.exe -
Loads dropped DLL 2 IoCs
pid Process 524 5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe 524 5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main hpigpwdrymrp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1892 hpigpwdrymrp.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1892 hpigpwdrymrp.exe 1892 hpigpwdrymrp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 524 wrote to memory of 1892 524 5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe 27 PID 524 wrote to memory of 1892 524 5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe 27 PID 524 wrote to memory of 1892 524 5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe 27 PID 524 wrote to memory of 1892 524 5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe"C:\Users\Admin\AppData\Local\Temp\5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\hpigpwdrymrp.exe"C:\Users\Admin\AppData\Local\Temp\\hpigpwdrymrp.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1892
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD58a1240360271b11d7be8e579c8aae55a
SHA1d5f399cea2aae630772f1090c83b3e3353ed833f
SHA25681b9fdc86475fe81c05f0feeef0b233e1386802a57c7050f63409181b5feb827
SHA512f1baf606ef670a94467962d95ab21fcb7257acdc5409d1430d15c2bc03bf7391f76c37a657f9cb0e7420a1cf3c34d430b022e1932701cad4504e7c2f08d0ac81
-
Filesize
451KB
MD5b0e2c156b901a5a87e947fea1ff56316
SHA1dc3761398275dedca78517dcaa61e281eef1ca51
SHA2565f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e
SHA5127a25c6b76be11c53748191849f236754947df0d14095f12319120cbbbcfc7dc655d544a85862dcd83f21db46971abd521897378c82cca86a51b43767935ca82d
-
Filesize
11KB
MD58a1240360271b11d7be8e579c8aae55a
SHA1d5f399cea2aae630772f1090c83b3e3353ed833f
SHA25681b9fdc86475fe81c05f0feeef0b233e1386802a57c7050f63409181b5feb827
SHA512f1baf606ef670a94467962d95ab21fcb7257acdc5409d1430d15c2bc03bf7391f76c37a657f9cb0e7420a1cf3c34d430b022e1932701cad4504e7c2f08d0ac81
-
Filesize
11KB
MD58a1240360271b11d7be8e579c8aae55a
SHA1d5f399cea2aae630772f1090c83b3e3353ed833f
SHA25681b9fdc86475fe81c05f0feeef0b233e1386802a57c7050f63409181b5feb827
SHA512f1baf606ef670a94467962d95ab21fcb7257acdc5409d1430d15c2bc03bf7391f76c37a657f9cb0e7420a1cf3c34d430b022e1932701cad4504e7c2f08d0ac81