Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    193s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2022, 11:26

General

  • Target

    116.exe

  • Size

    475KB

  • MD5

    5693b49732f95de6062b19b6aea6d5b5

  • SHA1

    fe2266c677a09e28fb86016331371976c133e7fd

  • SHA256

    30ac74e39be0cf57579fbffbda9138386b2eefd45eac6df28da251d43a0d3d42

  • SHA512

    fa7cb7f97b728322280a652d2f49735bf49daf47f5af6d50789c95d53979971255774bbadcf03a32e481dac17ec5e4905ab0221658f47ffdc12bc1a0727b80db

  • SSDEEP

    6144:1DpoeHt8QJCUN0C7Py1av5oam+vqFvmkHf3HZHLhSk2cKgL:ZtVTN0C7PyktXVVk2cbL

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\116.exe
    "C:\Users\Admin\AppData\Local\Temp\116.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\116.exe
      "C:\Users\Admin\AppData\Local\Temp\116.exe"
      2⤵
        PID:2972

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsl55C3.tmp\lichenologist.dll

      Filesize

      66KB

      MD5

      42e4078c829a2e1d2734b0033847d2cc

      SHA1

      5f0279f9190c168d345e024f1e4b8739aec63cfc

      SHA256

      4cb8de133b9d26ba4d41ed9b4bae121e4b86760805d89f97331e2b5cbb4670b2

      SHA512

      56be830839f3a728cf844c1656a3cad1aed77d71754d5350b7133f4b02e5c947bcae5be23d7668f13255779ed8e51cc3001b831c76d777cb9e88343d23c093f2

    • memory/2972-134-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB

    • memory/2972-136-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB