Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    113s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 18:49

General

  • Target

    0da5f875936ee03aefd2bc838a196e1aa0b263b2eaee36d0cc408f34b9c0e77b.exe

  • Size

    104KB

  • MD5

    14123fdda0f075d0f0d4ef8e6ed9d03b

  • SHA1

    ee375ce9fcb6a85ab5b2637053cddd903296ba93

  • SHA256

    0da5f875936ee03aefd2bc838a196e1aa0b263b2eaee36d0cc408f34b9c0e77b

  • SHA512

    7276d599b10417466a19d1ef75ff9a7de5256bd0a42097f1ac28ce5ee90219aaba7c328aeb4bb22a13f99b2091d2fbb10ff830eb9a53f4523c5776ebde202308

  • SSDEEP

    1536:XpS6Njj0m+HBc+hFKNIqpOGQvLsTZF6ocdoXjLl0MX:51+FrKNZ3QvLsT0o3mMX

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0da5f875936ee03aefd2bc838a196e1aa0b263b2eaee36d0cc408f34b9c0e77b.exe
    "C:\Users\Admin\AppData\Local\Temp\0da5f875936ee03aefd2bc838a196e1aa0b263b2eaee36d0cc408f34b9c0e77b.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\laiec.exe
      "C:\Users\Admin\laiec.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:844

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\laiec.exe

    Filesize

    104KB

    MD5

    d7f050fec9016b37b736172c4542b6fe

    SHA1

    556107a49ac919c46ded8bb949e67492f4aa189e

    SHA256

    b9438e7f0f74f027595e5149d4838548b7c149f0fc9d3c3ffe3b77b750645e63

    SHA512

    3bf18d7d6529bb2fabb019a6340271aa6bbde6996733db8b59984d3c430aa9bc4d917b3a83f064d94e09aeba90d19e88270c5ed3baa1d5b6222fe103a398073a

  • C:\Users\Admin\laiec.exe

    Filesize

    104KB

    MD5

    d7f050fec9016b37b736172c4542b6fe

    SHA1

    556107a49ac919c46ded8bb949e67492f4aa189e

    SHA256

    b9438e7f0f74f027595e5149d4838548b7c149f0fc9d3c3ffe3b77b750645e63

    SHA512

    3bf18d7d6529bb2fabb019a6340271aa6bbde6996733db8b59984d3c430aa9bc4d917b3a83f064d94e09aeba90d19e88270c5ed3baa1d5b6222fe103a398073a

  • \Users\Admin\laiec.exe

    Filesize

    104KB

    MD5

    d7f050fec9016b37b736172c4542b6fe

    SHA1

    556107a49ac919c46ded8bb949e67492f4aa189e

    SHA256

    b9438e7f0f74f027595e5149d4838548b7c149f0fc9d3c3ffe3b77b750645e63

    SHA512

    3bf18d7d6529bb2fabb019a6340271aa6bbde6996733db8b59984d3c430aa9bc4d917b3a83f064d94e09aeba90d19e88270c5ed3baa1d5b6222fe103a398073a

  • \Users\Admin\laiec.exe

    Filesize

    104KB

    MD5

    d7f050fec9016b37b736172c4542b6fe

    SHA1

    556107a49ac919c46ded8bb949e67492f4aa189e

    SHA256

    b9438e7f0f74f027595e5149d4838548b7c149f0fc9d3c3ffe3b77b750645e63

    SHA512

    3bf18d7d6529bb2fabb019a6340271aa6bbde6996733db8b59984d3c430aa9bc4d917b3a83f064d94e09aeba90d19e88270c5ed3baa1d5b6222fe103a398073a

  • memory/1420-56-0x0000000075C81000-0x0000000075C83000-memory.dmp

    Filesize

    8KB