Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    182s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 07:56

General

  • Target

    d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465.exe

  • Size

    614KB

  • MD5

    ec1f7ae1c76bf0e00a1df1017c9b54e7

  • SHA1

    b5f31088806dc13b4031eccb2c3ccd7c258ed6f0

  • SHA256

    d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465

  • SHA512

    2c8409c7c17e22feebefe942c9f18cb698de2ce0d0b339d2448882bb23d5221a0c82c988dd70d8c3a9e836022c225649274d3ceba7fbf7f08915ddeb8edb43cf

  • SSDEEP

    12288:UYRN6Ul2gavsFJZC42Bu0aHpdjzwJ4baLN+gZPNOcmVuSR3O9cubD5:HKUl2wFJZCRBu0KA8VAnmVugubD5

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465.exe
    "C:\Users\Admin\AppData\Local\Temp\d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Users\Admin\AppData\Local\Temp\n5023\s5023.exe
      "C:\Users\Admin\AppData\Local\Temp\n5023\s5023.exe" baebb1152c8fbec85149604fBsmQ7DwCn8/w5dgEpf7qVSPNOi5JHxDu/Yf6zhnVTHXlYQQTFiuuygX5IHfZrzw36M9LIcLRuH+Elos95YaPt4abiKXkU0kM9E5FMx5TDjgXHZS5WfPjxxhG0inP0bArEt+0UA9Xk2yZN7HWwsco8gO32yB13txT9CcM /v "C:\Users\Admin\AppData\Local\Temp\d04c346ff6d81711555311c909a7af1eb9b077014a58cb607a4490b9ba352465.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:900

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n5023\s5023.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • C:\Users\Admin\AppData\Local\Temp\n5023\s5023.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • \Users\Admin\AppData\Local\Temp\n5023\s5023.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • \Users\Admin\AppData\Local\Temp\n5023\s5023.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • \Users\Admin\AppData\Local\Temp\n5023\s5023.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • \Users\Admin\AppData\Local\Temp\n5023\s5023.exe

    Filesize

    350KB

    MD5

    60f9fa6a5debd2cd96317dabe147c68b

    SHA1

    8f82a7369b15d5b7f552db5e4e9a65b01c41e8d5

    SHA256

    005d00feddcafbd28a38166745b6a42b238614cf3973f82db4be702064856aae

    SHA512

    1124695d1da7cbc28ec3fe80f0b9a4384948f9a707c0ad250d1999f14171e501cabc70792fc8adb6cbfbcf1504634ee3520aec436992a5d46f6319d0418b6fd6

  • memory/900-62-0x000007FEF3490000-0x000007FEF3EB3000-memory.dmp

    Filesize

    10.1MB

  • memory/900-63-0x000007FEF1D10000-0x000007FEF2DA6000-memory.dmp

    Filesize

    16.6MB

  • memory/900-64-0x0000000000B86000-0x0000000000BA5000-memory.dmp

    Filesize

    124KB

  • memory/900-65-0x000007FEEDEB0000-0x000007FEEED3F000-memory.dmp

    Filesize

    14.6MB

  • memory/900-66-0x000007FEF2DF0000-0x000007FEF30DA000-memory.dmp

    Filesize

    2.9MB

  • memory/900-67-0x0000000000B86000-0x0000000000BA5000-memory.dmp

    Filesize

    124KB

  • memory/956-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

    Filesize

    8KB