Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    85s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 09:27

General

  • Target

    da893d1ffb08d9ffda880f0ed93281d819f28f62e2a6c7e246838509c5cc126b.exe

  • Size

    619KB

  • MD5

    358a0bf9306269c03ea11f45c0f1ba22

  • SHA1

    3cae791f05bd89d551b8ad202c9420caa7f9a21c

  • SHA256

    da893d1ffb08d9ffda880f0ed93281d819f28f62e2a6c7e246838509c5cc126b

  • SHA512

    1cfa8840b9f534f2b41859d72d88a8a71df896abca5e5bdf3a3e72c4eab274ea9fc47d8c11bf57aea9376a5e6d72a6eb1397845c3b1a4b612f4da4e9d6cc8ce0

  • SSDEEP

    12288:vIcc9FzHDY4Lz6XYdv82Lc+jG6Ehwi3Mo5UjiuY+nuVidYnkeXY+M:e9FzujSG6ElVKJYxkeXY+M

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da893d1ffb08d9ffda880f0ed93281d819f28f62e2a6c7e246838509c5cc126b.exe
    "C:\Users\Admin\AppData\Local\Temp\da893d1ffb08d9ffda880f0ed93281d819f28f62e2a6c7e246838509c5cc126b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\n5554\s5554.exe
      "C:\Users\Admin\AppData\Local\Temp\n5554\s5554.exe" cce498f825b71925aafd739cIPKkLszkvfQWoUnBLcNsfUYmuFiVyvVujNCPHsHNfdR4jW0pfyRl/P/tceWECxp9bxBX9WpwN3Uety6Sj24BInbBIC8RMcCv760yzTsfGMm39mESvxtXVZsyUIldM1jtJo28qHFiGDBLjSCMXGdTdgS/uj4HnlQNJu8sYmQ= /v "C:\Users\Admin\AppData\Local\Temp\da893d1ffb08d9ffda880f0ed93281d819f28f62e2a6c7e246838509c5cc126b.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:516

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n5554\s5554.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • C:\Users\Admin\AppData\Local\Temp\n5554\s5554.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • \Users\Admin\AppData\Local\Temp\n5554\s5554.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • \Users\Admin\AppData\Local\Temp\n5554\s5554.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • \Users\Admin\AppData\Local\Temp\n5554\s5554.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • \Users\Admin\AppData\Local\Temp\n5554\s5554.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • memory/516-62-0x000007FEF31D0000-0x000007FEF3BF3000-memory.dmp

    Filesize

    10.1MB

  • memory/516-63-0x000007FEF15D0000-0x000007FEF2666000-memory.dmp

    Filesize

    16.6MB

  • memory/516-64-0x0000000000A16000-0x0000000000A35000-memory.dmp

    Filesize

    124KB

  • memory/516-65-0x000007FEED190000-0x000007FEEE01F000-memory.dmp

    Filesize

    14.6MB

  • memory/516-66-0x000007FEF12E0000-0x000007FEF15CA000-memory.dmp

    Filesize

    2.9MB

  • memory/516-67-0x0000000000A16000-0x0000000000A35000-memory.dmp

    Filesize

    124KB

  • memory/1264-54-0x0000000075A31000-0x0000000075A33000-memory.dmp

    Filesize

    8KB