Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26/11/2022, 23:36 UTC
General
-
Target
7a8917b6874b2b784a65d3ea607e2aca4ec70759a0988df2447ab382f9d97a0f.exe
-
Size
3.1MB
-
MD5
dd95633aa17df1769dddf264d040c727
-
SHA1
8472e1044906735158338adb0b83053859828f15
-
SHA256
7a8917b6874b2b784a65d3ea607e2aca4ec70759a0988df2447ab382f9d97a0f
-
SHA512
d7991ae5ed81b528b26e69af81dce204da17ff19031ce196130753a5a9fcde770faba40892a6e06c76ab73f216fae066fcdb068085c1ff45b619a4812575439f
-
SSDEEP
98304:/AfbLA5wxEPASLkVmiJogPnNweHIBebSivZnk:/UkmIASQDJoEye2Ua
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a8917b6874b2b784a65d3ea607e2aca4ec70759a0988df2447ab382f9d97a0f.exe"C:\Users\Admin\AppData\Local\Temp\7a8917b6874b2b784a65d3ea607e2aca4ec70759a0988df2447ab382f9d97a0f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E7DD8.tmp\7a8917b6874b2b784a65d3ea607e2aca4ec70759a0988df2447ab382f9d97a0f.tmp"C:\Users\Admin\AppData\Local\Temp\is-E7DD8.tmp\7a8917b6874b2b784a65d3ea607e2aca4ec70759a0988df2447ab382f9d97a0f.tmp" /SL5="$30068,2529716,70144,C:\Users\Admin\AppData\Local\Temp\7a8917b6874b2b784a65d3ea607e2aca4ec70759a0988df2447ab382f9d97a0f.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
- No results found
-
72.21.91.29:80 -
67.27.154.126:80
-
20.189.173.10:443
-
93.184.220.29:80
-
8.238.110.126:80
-
8.238.111.254:80
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183KB
MD5db25dfdd4c1f2b65c68a230881072695
SHA194cd6a3438041f0e61b0a1bea7b66461854efe69
SHA2561b66aaf1e7e3c493dd96af3b7442ea60072f6e93ba45281eacd31a14ca7e7e73
SHA512db69e4ab2218856e5184d9094e7e39705b83e3efdc15225067205c8faf6e5836145364f1d509192defa3b48864e72b9f8c0f2dc53a7adb2b86c655318b7afc2c
-
Filesize
183KB
MD5db25dfdd4c1f2b65c68a230881072695
SHA194cd6a3438041f0e61b0a1bea7b66461854efe69
SHA2561b66aaf1e7e3c493dd96af3b7442ea60072f6e93ba45281eacd31a14ca7e7e73
SHA512db69e4ab2218856e5184d9094e7e39705b83e3efdc15225067205c8faf6e5836145364f1d509192defa3b48864e72b9f8c0f2dc53a7adb2b86c655318b7afc2c
-
Filesize
1.2MB
MD5e7106fbf42fbc6d5b08a18ada4f781b4
SHA136d4a629f79d772c0b0df8bd2ae2ea09108d239d
SHA25664e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635
SHA512adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845
-
Filesize
1.2MB
MD5e7106fbf42fbc6d5b08a18ada4f781b4
SHA136d4a629f79d772c0b0df8bd2ae2ea09108d239d
SHA25664e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635
SHA512adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845
-
Filesize
220KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB