Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe
Resource
win10v2004-20220812-en
General
-
Target
93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe
-
Size
881KB
-
MD5
03afa7424847aec7883578cbc1a246f0
-
SHA1
b0ed280ecc216babecdfb5eaf3dcc7afbc974276
-
SHA256
93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767
-
SHA512
5dd8068b26e3458e62d1f1526825363b178b146a624ed46b4b335efeac4687242486f6e94ce219c984ad30682d97134819d6834272a8794efa7e5afc445e5b27
-
SSDEEP
24576:5aOP7OqX1twj3DR+sjdbjtr+uGCtNk0142FTwTOdb98rni:j7Ouqzd+eFKuGCw01HF8qki
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 980 svchost.exe 892 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 584 svchost.exe -
Loads dropped DLL 6 IoCs
pid Process 980 svchost.exe 892 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 892 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 892 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 892 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 892 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\!Free Easy CD DVD BurnerOnce = "C:\\Users\\Admin\\AppData\\Local\\Temp\\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe" 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Free Easy CD DVD Burner\log.log 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe\IsHostApp 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 892 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2024 wrote to memory of 980 2024 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 27 PID 2024 wrote to memory of 980 2024 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 27 PID 2024 wrote to memory of 980 2024 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 27 PID 2024 wrote to memory of 980 2024 93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe 27 PID 980 wrote to memory of 892 980 svchost.exe 28 PID 980 wrote to memory of 892 980 svchost.exe 28 PID 980 wrote to memory of 892 980 svchost.exe 28 PID 980 wrote to memory of 892 980 svchost.exe 28 PID 980 wrote to memory of 892 980 svchost.exe 28 PID 980 wrote to memory of 892 980 svchost.exe 28 PID 980 wrote to memory of 892 980 svchost.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe"C:\Users\Admin\AppData\Local\Temp\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe"C:\Users\Admin\AppData\Local\Temp\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:892
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
PID:584
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe
Filesize845KB
MD5c12b4138fdc212edefaab64eb65139b6
SHA15c3c82a2baeca5658f3f7805e13c4877ca775179
SHA2565a024b79071e13865f0636d860af3880799366aceef988ca6501173de9b4c2e6
SHA51207e30feba822394dfd2cad30284a8858347eff5440385e9752c53aaed301c154aa85c2f7c9de76991d5dd04542ea95c6be12b67a01b94c6482db14bcab559ccf
-
C:\Users\Admin\AppData\Local\Temp\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe
Filesize845KB
MD5c12b4138fdc212edefaab64eb65139b6
SHA15c3c82a2baeca5658f3f7805e13c4877ca775179
SHA2565a024b79071e13865f0636d860af3880799366aceef988ca6501173de9b4c2e6
SHA51207e30feba822394dfd2cad30284a8858347eff5440385e9752c53aaed301c154aa85c2f7c9de76991d5dd04542ea95c6be12b67a01b94c6482db14bcab559ccf
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
\Users\Admin\AppData\Local\Temp\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe
Filesize845KB
MD5c12b4138fdc212edefaab64eb65139b6
SHA15c3c82a2baeca5658f3f7805e13c4877ca775179
SHA2565a024b79071e13865f0636d860af3880799366aceef988ca6501173de9b4c2e6
SHA51207e30feba822394dfd2cad30284a8858347eff5440385e9752c53aaed301c154aa85c2f7c9de76991d5dd04542ea95c6be12b67a01b94c6482db14bcab559ccf
-
\Users\Admin\AppData\Local\Temp\93ac296586556acca2f6e334aeffb1a866f2a2522913c11e94bc5b161eb01767.exe
Filesize845KB
MD5c12b4138fdc212edefaab64eb65139b6
SHA15c3c82a2baeca5658f3f7805e13c4877ca775179
SHA2565a024b79071e13865f0636d860af3880799366aceef988ca6501173de9b4c2e6
SHA51207e30feba822394dfd2cad30284a8858347eff5440385e9752c53aaed301c154aa85c2f7c9de76991d5dd04542ea95c6be12b67a01b94c6482db14bcab559ccf
-
Filesize
1.6MB
MD5c7249b6267fd8889bccb77221210bb4f
SHA1bb490a18c6da889ca86bbb7c52fa4bcdb51e0a76
SHA256eccee8596efa1bbad007e6552d0607540ff2f14a4fc4427ba92bcd1b107b2862
SHA512c1fe321ccdd8e4a68c3664bbf9cf90bee4aeef90ffd14c2ae86696a7d39074e9beaca1d05a59a5d6aed215d67b54a25116bed034a257e3a5633c4bd38de9fe96
-
Filesize
11KB
MD5959ea64598b9a3e494c00e8fa793be7e
SHA140f284a3b92c2f04b1038def79579d4b3d066ee0
SHA25603cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
SHA5125e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
-
Filesize
13KB
MD5a88baad3461d2e9928a15753b1d93fd7
SHA1bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA256c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
SHA5125edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
-
Filesize
9KB
MD5f7b92b78f1a00a872c8a38f40afa7d65
SHA1872522498f69ad49270190c74cf3af28862057f2
SHA2562bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
SHA5123ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79