Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    32s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 08:50

General

  • Target

    19b7a0ff32e660642c4c8f15b4b7ba1ca4460509888e7c88480587bedde68318.exe

  • Size

    369KB

  • MD5

    ade6e001b25c2f9ee36ed7359c945708

  • SHA1

    7c8c8e1341d6bb8ed76802845dd413a5e1ae8dcc

  • SHA256

    19b7a0ff32e660642c4c8f15b4b7ba1ca4460509888e7c88480587bedde68318

  • SHA512

    a9e41ccb6bd527fe111d62a9011564134481f56389e3c923c084cfeb69e6883d4f52d0488f09512e565047415ad9e06619e98d42930da07966e219e86b4327cb

  • SSDEEP

    6144:jBXZC83RkME2+3j9HiAreP4pGpVdzNBOFJcINhsgDVc5+lJyU8XgRQdPEFf6C:jBXZCZR2+T9HiArDodzSkE4C

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\19b7a0ff32e660642c4c8f15b4b7ba1ca4460509888e7c88480587bedde68318.exe
    "C:\Users\Admin\AppData\Local\Temp\19b7a0ff32e660642c4c8f15b4b7ba1ca4460509888e7c88480587bedde68318.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    PID:364

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\{ee4e07c7-1b4e-88fb-ee4e-e07c71b41f1c}\19b7a0ff32e660642c4c8f15b4b7ba1ca4460509888e7c88480587bedde68318.exe

    Filesize

    369KB

    MD5

    ade6e001b25c2f9ee36ed7359c945708

    SHA1

    7c8c8e1341d6bb8ed76802845dd413a5e1ae8dcc

    SHA256

    19b7a0ff32e660642c4c8f15b4b7ba1ca4460509888e7c88480587bedde68318

    SHA512

    a9e41ccb6bd527fe111d62a9011564134481f56389e3c923c084cfeb69e6883d4f52d0488f09512e565047415ad9e06619e98d42930da07966e219e86b4327cb

  • memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

    Filesize

    8KB

  • memory/364-55-0x0000000000280000-0x00000000002AC000-memory.dmp

    Filesize

    176KB