Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    40s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 05:10

General

  • Target

    a72522a81cc4d932d19607527409afbb26da0803ddbf4c25d01acfaac8609cb2.exe

  • Size

    892KB

  • MD5

    9cfb085cbf0c0824947c50875b861765

  • SHA1

    f8fe00172bddb0d543a6ab5339c12bee3881846d

  • SHA256

    a72522a81cc4d932d19607527409afbb26da0803ddbf4c25d01acfaac8609cb2

  • SHA512

    01b2dd0b1a4b2fd11cacb44d16493f88a8108f565e05213b80fe65d57b6020f4d51891e7b308161f5aea4d2e251ab4920cb86fb1debed48493ad57be2a848251

  • SSDEEP

    12288:vmf11hlRtWPfJ6MxNsi4UrEcNw6iaE5jz9NbL5aR5nWFpPoSjUggw:vmf11hlRyfJ6QNN4gEeC5X9XBbVvg

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a72522a81cc4d932d19607527409afbb26da0803ddbf4c25d01acfaac8609cb2.exe
    "C:\Users\Admin\AppData\Local\Temp\a72522a81cc4d932d19607527409afbb26da0803ddbf4c25d01acfaac8609cb2.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1204
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x55c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2036

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1204-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

    Filesize

    8KB

  • memory/1204-55-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-57-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-58-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-59-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-60-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-62-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-64-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-66-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-68-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-72-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-74-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-78-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-80-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-84-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-88-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-92-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-96-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-98-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-100-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-94-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-90-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-86-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-82-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-76-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-70-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1204-101-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB