Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    202s
  • max time network
    193s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2022, 00:10

General

  • Target

    703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef.exe

  • Size

    927KB

  • MD5

    271641cd6ba6392dd896380a21483c9d

  • SHA1

    61b40ffdb0c9cf50361ec1c03731af0d57470d2b

  • SHA256

    703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef

  • SHA512

    f271305c0d9c50da9802f18874abf1b5823814d8c8a61faec3bdfc32b130702735337fe5525d830c6cb1caec2487f6e3164f04b76fd943ec9606629bb1d39519

  • SSDEEP

    12288:WhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aXWHuCBsxJgm+0kLf8hl1W:GRmJkcoQricOIQxiZY1iaXWjBs7221Rg

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef.exe
    "C:\Users\Admin\AppData\Local\Temp\703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1872
    • C:\Users\Admin\AppData\Local\Temp\703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef.exe
      "C:\Users\Admin\AppData\Local\Temp\703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\I2105047518.bat" "
        3⤵
          PID:1732

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef.exe

      Filesize

      927KB

      MD5

      271641cd6ba6392dd896380a21483c9d

      SHA1

      61b40ffdb0c9cf50361ec1c03731af0d57470d2b

      SHA256

      703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef

      SHA512

      f271305c0d9c50da9802f18874abf1b5823814d8c8a61faec3bdfc32b130702735337fe5525d830c6cb1caec2487f6e3164f04b76fd943ec9606629bb1d39519

    • C:\Users\Admin\AppData\Local\Temp\I2105047518.bat

      Filesize

      23B

      MD5

      97aae1211f3a9c7ecd8531ee87ed5354

      SHA1

      3cec50b07d80bb054e90458d795e9867ba678851

      SHA256

      8668f8216a6e5ab8ff1fb5d4ad886ba768c843eb98394cd260d53e8ed4fbc145

      SHA512

      0fd8e9b2eb6a92794b569b7a29ff6609e81e1bb90ef2cb58cec29cf6c37b32fd82879ad24a1a7fef0ade0c6a8a3a1a7b7d7b7171e0c36cfac0b24df52aba6f1e

    • \Users\Admin\AppData\Local\Temp\703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef.exe

      Filesize

      927KB

      MD5

      271641cd6ba6392dd896380a21483c9d

      SHA1

      61b40ffdb0c9cf50361ec1c03731af0d57470d2b

      SHA256

      703e86c3a4536a725689e714cee8c344c5a461a9faf230c6e144c243661ff1ef

      SHA512

      f271305c0d9c50da9802f18874abf1b5823814d8c8a61faec3bdfc32b130702735337fe5525d830c6cb1caec2487f6e3164f04b76fd943ec9606629bb1d39519

    • memory/1328-59-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1328-60-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1328-63-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1328-56-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1328-65-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1328-66-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1328-67-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1328-68-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1328-69-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1328-57-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1872-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

      Filesize

      8KB