Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    169s
  • max time network
    184s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25/11/2022, 18:29

General

  • Target

    5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe

  • Size

    451KB

  • MD5

    b0e2c156b901a5a87e947fea1ff56316

  • SHA1

    dc3761398275dedca78517dcaa61e281eef1ca51

  • SHA256

    5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e

  • SHA512

    7a25c6b76be11c53748191849f236754947df0d14095f12319120cbbbcfc7dc655d544a85862dcd83f21db46971abd521897378c82cca86a51b43767935ca82d

  • SSDEEP

    6144:SvaqS4IR/kviXzd4twM19AwCflNKBek0egb3CZF8/yoYZeiEzK4NKzLBM4cUvpSp:h/kviXzdtmJwNKBekM3GoYTEDeBf40bI

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe
    "C:\Users\Admin\AppData\Local\Temp\5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:524
    • C:\Users\Admin\AppData\Local\Temp\hpigpwdrymrp.exe
      "C:\Users\Admin\AppData\Local\Temp\\hpigpwdrymrp.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1892

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hpigpwdrymrp.exe

    Filesize

    11KB

    MD5

    8a1240360271b11d7be8e579c8aae55a

    SHA1

    d5f399cea2aae630772f1090c83b3e3353ed833f

    SHA256

    81b9fdc86475fe81c05f0feeef0b233e1386802a57c7050f63409181b5feb827

    SHA512

    f1baf606ef670a94467962d95ab21fcb7257acdc5409d1430d15c2bc03bf7391f76c37a657f9cb0e7420a1cf3c34d430b022e1932701cad4504e7c2f08d0ac81

  • C:\Users\Admin\AppData\Local\Temp\parent.txt

    Filesize

    451KB

    MD5

    b0e2c156b901a5a87e947fea1ff56316

    SHA1

    dc3761398275dedca78517dcaa61e281eef1ca51

    SHA256

    5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e

    SHA512

    7a25c6b76be11c53748191849f236754947df0d14095f12319120cbbbcfc7dc655d544a85862dcd83f21db46971abd521897378c82cca86a51b43767935ca82d

  • \Users\Admin\AppData\Local\Temp\hpigpwdrymrp.exe

    Filesize

    11KB

    MD5

    8a1240360271b11d7be8e579c8aae55a

    SHA1

    d5f399cea2aae630772f1090c83b3e3353ed833f

    SHA256

    81b9fdc86475fe81c05f0feeef0b233e1386802a57c7050f63409181b5feb827

    SHA512

    f1baf606ef670a94467962d95ab21fcb7257acdc5409d1430d15c2bc03bf7391f76c37a657f9cb0e7420a1cf3c34d430b022e1932701cad4504e7c2f08d0ac81

  • \Users\Admin\AppData\Local\Temp\hpigpwdrymrp.exe

    Filesize

    11KB

    MD5

    8a1240360271b11d7be8e579c8aae55a

    SHA1

    d5f399cea2aae630772f1090c83b3e3353ed833f

    SHA256

    81b9fdc86475fe81c05f0feeef0b233e1386802a57c7050f63409181b5feb827

    SHA512

    f1baf606ef670a94467962d95ab21fcb7257acdc5409d1430d15c2bc03bf7391f76c37a657f9cb0e7420a1cf3c34d430b022e1932701cad4504e7c2f08d0ac81

  • memory/1892-58-0x000007FEF3E10000-0x000007FEF4833000-memory.dmp

    Filesize

    10.1MB

  • memory/1892-59-0x000007FEF2D70000-0x000007FEF3E06000-memory.dmp

    Filesize

    16.6MB

  • memory/1892-61-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

    Filesize

    8KB