Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    199s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 10:25

General

  • Target

    ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd.exe

  • Size

    625KB

  • MD5

    d0b364f822671f87eb9d4770e11ecb14

  • SHA1

    bafe475014d7e6f2e9cc6cbbcad91f3096d8e5f4

  • SHA256

    ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd

  • SHA512

    4f3ccbbd81f09903f42a5966114c80c971cb3066d319b3238fb5ea6ecc690a728ae8207a8f6772b6ebca5ad8789178eda29a818c8bdbde7e4d8cc8eaa14c8f85

  • SSDEEP

    12288:hg+gjjwmSK3ALgXgxvFDyfD1XBxzHMT0jZOJk7j4epPfArQyX0kZ2GEV4gB4IjY3:CjjwS3UW0NKhXLNjZzTPIrQu0kZCV4gS

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd.exe
    "C:\Users\Admin\AppData\Local\Temp\ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Users\Admin\AppData\Local\Temp\n7471\s7471.exe
      "C:\Users\Admin\AppData\Local\Temp\n7471\s7471.exe" 1d68d7d720be5c195a286c56G1mzhs/RIyfpCNjUJN4MP9Scsl2FEjqnyB9VUtdk4bDi5GiAzK3dS/sDj1fVG6Q3ee42xTsZDAo3GOapd0Tr0V2SDAlWXHwEusQJn4CT0wYplNd731cVktFazKLXoJztv4ScQAfD3P5nVXlIJ3obb5mEPcl00PKi6GgfT1s= /v "C:\Users\Admin\AppData\Local\Temp\ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:540

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n7471\s7471.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • C:\Users\Admin\AppData\Local\Temp\n7471\s7471.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • \Users\Admin\AppData\Local\Temp\n7471\s7471.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • \Users\Admin\AppData\Local\Temp\n7471\s7471.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • \Users\Admin\AppData\Local\Temp\n7471\s7471.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • \Users\Admin\AppData\Local\Temp\n7471\s7471.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • memory/540-62-0x000007FEF4440000-0x000007FEF4E63000-memory.dmp

    Filesize

    10.1MB

  • memory/540-63-0x000007FEF3160000-0x000007FEF41F6000-memory.dmp

    Filesize

    16.6MB

  • memory/540-64-0x0000000001F76000-0x0000000001F95000-memory.dmp

    Filesize

    124KB

  • memory/540-65-0x000007FEEEB50000-0x000007FEEF9DF000-memory.dmp

    Filesize

    14.6MB

  • memory/540-66-0x000007FEEE860000-0x000007FEEEB4A000-memory.dmp

    Filesize

    2.9MB

  • memory/540-67-0x0000000001F76000-0x0000000001F95000-memory.dmp

    Filesize

    124KB

  • memory/540-68-0x0000000001F76000-0x0000000001F95000-memory.dmp

    Filesize

    124KB

  • memory/1472-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

    Filesize

    8KB