Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    76s
  • max time network
    59s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/11/2022, 02:00

General

  • Target

    7a108a4477a9b37e89d9be7e0d2bbec1d184b46ba0c9135fca3ee3735874d385.exe

  • Size

    1.4MB

  • MD5

    a9960bd86296a61632c5b1049bd0f6f0

  • SHA1

    2f2d6b06b685420c1913a592cee11bf07d22e256

  • SHA256

    7a108a4477a9b37e89d9be7e0d2bbec1d184b46ba0c9135fca3ee3735874d385

  • SHA512

    2e740eada8fc8545ab98f11cca9e98bd7f761c678c64da5b8a081f429e50dd905fac65d22094938a95d2a0b33c5cf8981de2c9281a5b19ac77d188e9578926a4

  • SSDEEP

    24576:4ry2uXzmVLTph1biXtFPHvgx59Qg5xD9JZ26YEYeDTTKFPDm8u2M:4unKhViXtFPHkfBYrevmFPDmaM

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a108a4477a9b37e89d9be7e0d2bbec1d184b46ba0c9135fca3ee3735874d385.exe
    "C:\Users\Admin\AppData\Local\Temp\7a108a4477a9b37e89d9be7e0d2bbec1d184b46ba0c9135fca3ee3735874d385.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" .\_cvW7A.6F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\_cvW7A.6F
        3⤵
        • Loads dropped DLL
        PID:4376

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_cvW7A.6F

    Filesize

    2.2MB

    MD5

    40353de0ec1019842e054683d81350c6

    SHA1

    343197d9ca8a4d2c29cd23560f4f9978b44d0349

    SHA256

    4903c94dc6bd9c053a96c6ca6f9e3ecbd9646c6d04ecaa2e370ac5fbc90b4195

    SHA512

    43905ed47e0edd142216debbccb8571b50e39ded5a55966f2c329c9632cf43eb6c6f3862edf9cf89059682d683172af33babfd81eaa45eb4e888836eb4b1205f

  • \Users\Admin\AppData\Local\Temp\_cvW7a.6f

    Filesize

    2.2MB

    MD5

    40353de0ec1019842e054683d81350c6

    SHA1

    343197d9ca8a4d2c29cd23560f4f9978b44d0349

    SHA256

    4903c94dc6bd9c053a96c6ca6f9e3ecbd9646c6d04ecaa2e370ac5fbc90b4195

    SHA512

    43905ed47e0edd142216debbccb8571b50e39ded5a55966f2c329c9632cf43eb6c6f3862edf9cf89059682d683172af33babfd81eaa45eb4e888836eb4b1205f

  • \Users\Admin\AppData\Local\Temp\_cvW7a.6f

    Filesize

    2.2MB

    MD5

    40353de0ec1019842e054683d81350c6

    SHA1

    343197d9ca8a4d2c29cd23560f4f9978b44d0349

    SHA256

    4903c94dc6bd9c053a96c6ca6f9e3ecbd9646c6d04ecaa2e370ac5fbc90b4195

    SHA512

    43905ed47e0edd142216debbccb8571b50e39ded5a55966f2c329c9632cf43eb6c6f3862edf9cf89059682d683172af33babfd81eaa45eb4e888836eb4b1205f

  • memory/2500-117-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-118-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-119-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-120-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-122-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-123-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-125-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-126-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-127-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-128-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-129-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-130-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-131-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-132-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-133-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-134-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-135-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-136-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-137-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-138-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-139-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-140-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-141-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-142-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-143-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-144-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-145-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-146-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-147-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-148-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-150-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-149-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-151-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-152-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-153-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-154-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-155-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-156-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-157-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-158-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-159-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-160-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-161-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-162-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-163-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-164-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-165-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-166-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-168-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-167-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-169-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-170-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-171-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-172-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-173-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-174-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-175-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-176-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-177-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-178-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-179-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-180-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-181-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB

  • memory/3380-183-0x0000000077580000-0x000000007770E000-memory.dmp

    Filesize

    1.6MB