Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 16:59

General

  • Target

    daa541f24c746fa40fe2152cb74aa165b5b20d0199456ec065508cb599e5be35.exe

  • Size

    380KB

  • MD5

    f16403f9a5d784aa1987c301c026afca

  • SHA1

    c7cc677026806af51997ceb145bf40dd68f53902

  • SHA256

    daa541f24c746fa40fe2152cb74aa165b5b20d0199456ec065508cb599e5be35

  • SHA512

    46b008c92b1d6749f28ac99b2c4dc8d27bffde00777eaae3bccbd57cd169a6375d630f99a8fc9a516f0bac36efea503a0b8ff6323b6542ad1dd8bc74e1c4e9d1

  • SSDEEP

    6144:mzs7gXYiNt5J755qGBmw3a/ov/AEd5WqLyXjspU3XAGeLz4e6yerbGyvgZE:+dHNt5JdDZa/oQhqWFgZE

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\daa541f24c746fa40fe2152cb74aa165b5b20d0199456ec065508cb599e5be35.exe
    "C:\Users\Admin\AppData\Local\Temp\daa541f24c746fa40fe2152cb74aa165b5b20d0199456ec065508cb599e5be35.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Drops file in Windows directory
    PID:1448

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\{b11368f2-75a9-9c78-b113-368f275aa3c9}\daa541f24c746fa40fe2152cb74aa165b5b20d0199456ec065508cb599e5be35.exe

    Filesize

    380KB

    MD5

    f16403f9a5d784aa1987c301c026afca

    SHA1

    c7cc677026806af51997ceb145bf40dd68f53902

    SHA256

    daa541f24c746fa40fe2152cb74aa165b5b20d0199456ec065508cb599e5be35

    SHA512

    46b008c92b1d6749f28ac99b2c4dc8d27bffde00777eaae3bccbd57cd169a6375d630f99a8fc9a516f0bac36efea503a0b8ff6323b6542ad1dd8bc74e1c4e9d1

  • memory/1448-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

    Filesize

    8KB

  • memory/1448-55-0x00000000001E0000-0x000000000020F000-memory.dmp

    Filesize

    188KB