Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
Power.Shutdown.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Power.Shutdown.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
keygen.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
keygen.exe
Resource
win10v2004-20220812-en
General
-
Target
Power.Shutdown.exe
-
Size
1016KB
-
MD5
c744c900d7db01bf7acfc535ea68b320
-
SHA1
d0133c460aa13ad82b1da0ace41c08597642b3c4
-
SHA256
ed87e8f3fe080c284242c85770a6b692917d10b07c53e9013e8db20c885b813c
-
SHA512
05c7da1842ae8836e2e96b46352ac57e997079ca341d096e9c22c190f8cb966e6ab23ed6642a33eaaa3db61aea1295db08cefe21e60423815bcb485d0aef5372
-
SSDEEP
24576:Z2e2owJdy5IaXD9sP8rtBg4g6aRkHUREK9fY2Q6w+Pq7:Z2TowJdiT9s2nqk0mK9A9S8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1612 is-TT8PJ.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4092 wrote to memory of 1612 4092 Power.Shutdown.exe 81 PID 4092 wrote to memory of 1612 4092 Power.Shutdown.exe 81 PID 4092 wrote to memory of 1612 4092 Power.Shutdown.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\Power.Shutdown.exe"C:\Users\Admin\AppData\Local\Temp\Power.Shutdown.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\is-LJBLC.tmp\is-TT8PJ.tmp"C:\Users\Admin\AppData\Local\Temp\is-LJBLC.tmp\is-TT8PJ.tmp" /SL4 $90028 "C:\Users\Admin\AppData\Local\Temp\Power.Shutdown.exe" 801958 527362⤵
- Executes dropped EXE
PID:1612
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
657KB
MD53dafb498bb15d5260cb2c12b391a0d48
SHA1c775ae9fdf18ab0ce38a8adffabe378f461e79a1
SHA256c5d5f5f814c5bc4989d691442051e5e78cf1971eb9b773a7a26b438e58a73d7a
SHA512a42f39a73bd4615490c6e33c017fa09f9992e3327d244b050b6634ad696d421170fd63ec5d5e66e92d112dc804eabd0bcd56494c9499d78fad8b46fe2ef32a31
-
Filesize
657KB
MD53dafb498bb15d5260cb2c12b391a0d48
SHA1c775ae9fdf18ab0ce38a8adffabe378f461e79a1
SHA256c5d5f5f814c5bc4989d691442051e5e78cf1971eb9b773a7a26b438e58a73d7a
SHA512a42f39a73bd4615490c6e33c017fa09f9992e3327d244b050b6634ad696d421170fd63ec5d5e66e92d112dc804eabd0bcd56494c9499d78fad8b46fe2ef32a31