Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
28/11/2022, 01:27
General
-
Target
ae83347e7e7c4443e6b87ca047ca5b883b8dc8e044e6e85efec4bd2ab7e91d85.exe
-
Size
216KB
-
MD5
a421dd1b9061ab37b5f379d3f6da038c
-
SHA1
fc3ccbf1570613a4f27e403593033a6d2e4616d0
-
SHA256
ae83347e7e7c4443e6b87ca047ca5b883b8dc8e044e6e85efec4bd2ab7e91d85
-
SHA512
f6f9e6604a6fbc757551f194765a9eefeb9df7ef8d266fdc7865384b22fbc6959076cacd45d646da552ffd3e1ed319834ff4415f2f8f093cde98dda1d3e4e76c
-
SSDEEP
1536:9gG9hAmbzNhf3ldAmD+DJ2TXxz1kfmzJIbLiXQFcd6C+Xgb+1Eqmc9CJxuZA9/i6:9gGz/zTxIAjzMmObug+6BgbQEU
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae83347e7e7c4443e6b87ca047ca5b883b8dc8e044e6e85efec4bd2ab7e91d85.exe"C:\Users\Admin\AppData\Local\Temp\ae83347e7e7c4443e6b87ca047ca5b883b8dc8e044e6e85efec4bd2ab7e91d85.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158KB
MD56d43f89b4495ab4398067546d17cd19f
SHA1238b727e230795732307493db686b0ca0b1d69b1
SHA2562710f5f8971fd505e922b30bf4ad60209500ff518db8b635b7f51b538ecb9aa2
SHA512f20ead3df266831e258e27db6bc643e7fc57910e9707a1f25279ef446662662fedcce5ac33d9ef59f3f015a158b8b6244456f08ffa6d7b3830272cc182767230
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
