Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
61s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe
Resource
win10v2004-20220812-en
General
-
Target
ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe
-
Size
68KB
-
MD5
bd31cfeab12564dea424d85e8693efd7
-
SHA1
51cddee3c82490b0b142f80aeaf9c30e967d41c9
-
SHA256
ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198
-
SHA512
165d5cadac3bb17e46b91df9ed68354e20aad51697e2d3bda5599d58f5424db409c5104d696ece675e692c305913679a7897ee6438a436a4f508fe49746725b7
-
SSDEEP
768:FctliTd6CAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:itIx9AcqOK3qowgnt1d
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Admin.exe -
Executes dropped EXE 1 IoCs
pid Process 1452 Admin.exe -
Loads dropped DLL 2 IoCs
pid Process 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Admin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" Admin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1452 Admin.exe 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe 1452 Admin.exe 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe 1452 Admin.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1264 wrote to memory of 1452 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe 28 PID 1264 wrote to memory of 1452 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe 28 PID 1264 wrote to memory of 1452 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe 28 PID 1264 wrote to memory of 1452 1264 ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe"C:\Users\Admin\AppData\Local\Temp\ca564136e063b8da3ac397044e349ca90b585908174e8dee5ebfe0b6d9b29198.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1452
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD53d05b82f0d1af1736face884ed06f94b
SHA1f883cf3351097d30e7a65b796747e46e74ef1115
SHA2565e1216589a4518712aee4ce18787b89ecde4ed1108d2279f49338f2baf14c985
SHA512af7af5008934fc26d6da8cd9a9921d2d3d93b9fa7cb2498c8fbab83892847a44b786287bc114753c52c6a163e3968245a20cd38b22b4bacc38058eae68551ab5
-
Filesize
68KB
MD53d05b82f0d1af1736face884ed06f94b
SHA1f883cf3351097d30e7a65b796747e46e74ef1115
SHA2565e1216589a4518712aee4ce18787b89ecde4ed1108d2279f49338f2baf14c985
SHA512af7af5008934fc26d6da8cd9a9921d2d3d93b9fa7cb2498c8fbab83892847a44b786287bc114753c52c6a163e3968245a20cd38b22b4bacc38058eae68551ab5
-
Filesize
68KB
MD53d05b82f0d1af1736face884ed06f94b
SHA1f883cf3351097d30e7a65b796747e46e74ef1115
SHA2565e1216589a4518712aee4ce18787b89ecde4ed1108d2279f49338f2baf14c985
SHA512af7af5008934fc26d6da8cd9a9921d2d3d93b9fa7cb2498c8fbab83892847a44b786287bc114753c52c6a163e3968245a20cd38b22b4bacc38058eae68551ab5