Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    197s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 09:14

General

  • Target

    a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe

  • Size

    865KB

  • MD5

    2db64f19fb373f920eb10f3f608e3019

  • SHA1

    5cab6be09e0a04719fce6b36db363f394245baea

  • SHA256

    a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d

  • SHA512

    2e2a2697c053a48726e7dfea07e74e27ebfe5c570a27d3e26771a0df4c583aad6573722e43cffc22e9d5f4221729e73077bba7eda06a3077095ae73f164eb0f2

  • SSDEEP

    24576:KueEdBBdRzUDeXOPWdwhr26uZt2Ggu05EBBD:Ku9rFUDIOPWdsr2TZMGwSB5

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe
    "C:\Users\Admin\AppData\Local\Temp\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\launch.exe
      C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\launch.exe "ea12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe" "a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe" "01d8b5bcc49d4c89b07bf11982082e05" dec
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:432
    • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe
      C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe /path="C:\Users\Admin\AppData\Local\Temp\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1728

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\46DE64130271B61D13A0FAFD9465377C_D8840AF2A28227DC3600C6CA04024DE2

    Filesize

    1KB

    MD5

    7732f077eaacfc347275fec171a2bf7e

    SHA1

    fa4462662759b837bfc3e2b64f53384d19987d92

    SHA256

    5797a1145210b025bff94e0e41374a2c48348460b8b92eb991d79dc8b6afbb03

    SHA512

    01f608d0ed4d42329732434501f263cbd9ab939b7525086388987a6552078456bcf73fe51a2e2e9e1f318a1969a59124cfbbd0df5b8fd3015661847d94928212

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF

    Filesize

    1KB

    MD5

    8cc40061962d79d8887195a75e41c26c

    SHA1

    bb2888743678151da82ffa1d56396c2a852c1475

    SHA256

    551c972945e2b9bc16fa9787201f1ba80c3e27cac6a142f91ca2d5dec431e52b

    SHA512

    e8048ced8442774bc749deca1213d85a6d16dd404fe38cc1f91296d531ff40dd67360b95f76886420bb42f59e06c18c128d37252745c982e3444d79d5fc0aa11

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\46DE64130271B61D13A0FAFD9465377C_D8840AF2A28227DC3600C6CA04024DE2

    Filesize

    466B

    MD5

    0f07db4b9db5c6bd1caa036f178ab77b

    SHA1

    2d9718cb60432f0de61f3949e6ec74a9b2322473

    SHA256

    3892e3c449ded2e46b5ed0889c04f307bc7da975db19f9b7925767c1b10428b2

    SHA512

    6788bbc28f7f9403b570814c14c573553c2360ccfbb4dfeb11adc18a273c879f69ea3eec1303b61a6ad37a050510e9e76db2565c5d76f9eee8ea436c86a8d06f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    590d9d3097250fa66eb958a140f8c83d

    SHA1

    34e5b5f3de915d06c341319e0da9718d5f9e93f7

    SHA256

    b2236b5c70153c5d61fcda9ec65b6a6c71f0d1d2194bb14f1e8d727f0555c2d5

    SHA512

    8fa9be88800083f44eac9087226cf25f7a8bade118cbcb3ded01905f73b829e57641cc08329a81bf4027c55726bb15751e0d84c4de0dd8b94c108d8a82d812e8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF

    Filesize

    444B

    MD5

    654fccdb34c46efcb4c2e145acfed0bc

    SHA1

    0826d48fb0cea73e061626185155a2d69b7bb8d3

    SHA256

    1df0eff114e1be5d4655c63d6eda8a14df9d8da093977aa169a5e427a5756e32

    SHA512

    1a9da011cdfe3fc0658b756a70ee582431df4b71122283b01c7c21e4b8262ba01fbbbb8601df6f9f4737568b4fb44aded7688f445c37f0d1ef4d29565c70563f

  • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe

    Filesize

    383KB

    MD5

    97e1368eec99b16ca79cbd755576da26

    SHA1

    953997d6334ebc1cf70751cc3ecab039f8c0ebeb

    SHA256

    c2f57daf4313cf4f64b06e99dbbb316e3909017c72266ef94a9cf6399f9805c1

    SHA512

    e6c7ab15d1ee86fc4d1c7bccdca14ec5847ff24a2469bcdc8a921d827058bb287d1af007138422c0433c0a98b29539df3018caa7c92d909e991c288a392b0aa3

  • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe

    Filesize

    383KB

    MD5

    97e1368eec99b16ca79cbd755576da26

    SHA1

    953997d6334ebc1cf70751cc3ecab039f8c0ebeb

    SHA256

    c2f57daf4313cf4f64b06e99dbbb316e3909017c72266ef94a9cf6399f9805c1

    SHA512

    e6c7ab15d1ee86fc4d1c7bccdca14ec5847ff24a2469bcdc8a921d827058bb287d1af007138422c0433c0a98b29539df3018caa7c92d909e991c288a392b0aa3

  • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe.config

    Filesize

    690B

    MD5

    bca0ea75b6940aa86960d7b9098a5998

    SHA1

    3d57f82158ac72c7eb2e72ba19a80485d8103130

    SHA256

    5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

    SHA512

    260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

  • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\ea12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe

    Filesize

    383KB

    MD5

    bbe9c20caf6e7c3a5a05624abc44e720

    SHA1

    ab780a750934a5173f48b40e2a1a8960d76639c5

    SHA256

    290b122496e2be7b5987b06312e17275a42112250de37c53a15aa3b92e528f99

    SHA512

    00fa11867be8db24fd77ab77dbbae8c42a8ba7ee041eb5b642cb271316716a62ff068de19b102877cee39960e7d7e9253aaf838d61558a6f264319a39a2d3273

  • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\installer.exe

    Filesize

    865KB

    MD5

    2db64f19fb373f920eb10f3f608e3019

    SHA1

    5cab6be09e0a04719fce6b36db363f394245baea

    SHA256

    a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d

    SHA512

    2e2a2697c053a48726e7dfea07e74e27ebfe5c570a27d3e26771a0df4c583aad6573722e43cffc22e9d5f4221729e73077bba7eda06a3077095ae73f164eb0f2

  • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\launch.exe

    Filesize

    26KB

    MD5

    e2579df6879217499f05eef4725b3106

    SHA1

    905ab8f071c22be7a4fc78073d36121d17299464

    SHA256

    860372841f7d35c9e92f9b3d7c65c64a3904b02cbc41a5cd1318e571c27d9102

    SHA512

    40203c0cf7342894d05a7f4224add02206fb6d727e2e69d474d141778e556c0c3cfc3ce2a09d10c03c020fb5362904bac99890f0c3f316ce81c469fd59018645

  • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\launch.exe

    Filesize

    26KB

    MD5

    e2579df6879217499f05eef4725b3106

    SHA1

    905ab8f071c22be7a4fc78073d36121d17299464

    SHA256

    860372841f7d35c9e92f9b3d7c65c64a3904b02cbc41a5cd1318e571c27d9102

    SHA512

    40203c0cf7342894d05a7f4224add02206fb6d727e2e69d474d141778e556c0c3cfc3ce2a09d10c03c020fb5362904bac99890f0c3f316ce81c469fd59018645

  • C:\Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\launch.exe.config

    Filesize

    359B

    MD5

    05a59e8e79546860cf1e351e32e69404

    SHA1

    aef4ad7bcbd79f99feb7100f05938721f12f7dce

    SHA256

    a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

    SHA512

    6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

  • \Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe

    Filesize

    383KB

    MD5

    97e1368eec99b16ca79cbd755576da26

    SHA1

    953997d6334ebc1cf70751cc3ecab039f8c0ebeb

    SHA256

    c2f57daf4313cf4f64b06e99dbbb316e3909017c72266ef94a9cf6399f9805c1

    SHA512

    e6c7ab15d1ee86fc4d1c7bccdca14ec5847ff24a2469bcdc8a921d827058bb287d1af007138422c0433c0a98b29539df3018caa7c92d909e991c288a392b0aa3

  • \Users\Admin\AppData\Local\Temp\DM\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe\4515c26805cb4a70a0f37a832840a7b5\launch.exe

    Filesize

    26KB

    MD5

    e2579df6879217499f05eef4725b3106

    SHA1

    905ab8f071c22be7a4fc78073d36121d17299464

    SHA256

    860372841f7d35c9e92f9b3d7c65c64a3904b02cbc41a5cd1318e571c27d9102

    SHA512

    40203c0cf7342894d05a7f4224add02206fb6d727e2e69d474d141778e556c0c3cfc3ce2a09d10c03c020fb5362904bac99890f0c3f316ce81c469fd59018645

  • \Users\Admin\AppData\Local\Temp\nsjC075.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • memory/432-65-0x0000000073CD0000-0x000000007427B000-memory.dmp

    Filesize

    5.7MB

  • memory/432-63-0x0000000073CD0000-0x000000007427B000-memory.dmp

    Filesize

    5.7MB

  • memory/1356-54-0x0000000075091000-0x0000000075093000-memory.dmp

    Filesize

    8KB

  • memory/1356-56-0x0000000074341000-0x0000000074343000-memory.dmp

    Filesize

    8KB

  • memory/1728-77-0x000007FEF3550000-0x000007FEF3F73000-memory.dmp

    Filesize

    10.1MB

  • memory/1728-78-0x000007FEF24B0000-0x000007FEF3546000-memory.dmp

    Filesize

    16.6MB