Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    28/11/2022, 03:09

General

  • Target

    4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe

  • Size

    3.4MB

  • MD5

    ab7c18ee7a0346e2a021b8da90af1e8c

  • SHA1

    585967a65767e219f2dbdac89915dd660009a7e4

  • SHA256

    4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16

  • SHA512

    a22349b5af214f44e74446fc4c31f596603754a629a202668168961fcb06f93ac3ea1da1c5bf492098f81b1cc6188ed03e8bb22bdd7bdf46478fae268dd75d74

  • SSDEEP

    98304:fz8zeiPaHnUXynSKnQp06VyVFkhsfCYSquB9MQvKoGBT8awTFLOAkGkzdnEVEFox:M8UXqQgFk2fABeoGBT8awTFLOyEFoKG

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe
    "C:\Users\Admin\AppData\Local\Temp\4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\killfile.bat" "
      2⤵
      • Deletes itself
      PID:284

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\killfile.bat

    Filesize

    301B

    MD5

    07bfbdef3da8bbc561e7f9e68e3197ca

    SHA1

    7549fece37d0ab49c9222d3f977cbd29cce6a06d

    SHA256

    7d991721f260d3eb36d2101dbc5b509c91a6abe25db2eb8afdf1463734e567fd

    SHA512

    2cf59b1e8256613c67db29d4ca25b7760d6294342119547d5b643efdbd52de2f0db89a5ecd20e6ac7bd800d3a4291c574306084d932b027a9d5292a27583371b

  • memory/1252-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

    Filesize

    8KB