Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    199s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 11:50

General

  • Target

    97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

  • Size

    699KB

  • MD5

    c872c970f3490e1a5cec665ced0a5e9b

  • SHA1

    42c6e3bde1c74bbfe294b73f9c014cbe9b4a6a32

  • SHA256

    97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14

  • SHA512

    e1c7d587b20410d7dcf7fd69766a5f21b77265435228c6a88b385f3bb31bb5caf812c0519aa9ca3dfcc861c1c8d3dd3d6a6ffba2f4565cb6b366fae40b67ccda

  • SSDEEP

    12288:Duud4ptYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfQ9fUQ27W+yoszFjMTeWGt:Due4YT/hmflRBmqPeQ93D4AQI9f2oz8c

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe
    "C:\Users\Admin\AppData\Local\Temp\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe
      C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe "e97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe" "97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe" "5799b77b367146d4a32112752349ed38" dec
      2⤵
      • Executes dropped EXE
      PID:1744
    • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe
      C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe /path="C:\Users\Admin\AppData\Local\Temp\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:796

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

    Filesize

    223KB

    MD5

    1d417f92be7a5a2c5bb3b1897e152695

    SHA1

    ed31727207fe529f94a21c8163c97c908775a249

    SHA256

    8c535c92d33c79f06c0af6eb00a6b4ef0dac7bbdcef26aeea629d15e51f0c7ef

    SHA512

    34049c1168f729f1dbc1b58f487fa16c5730ced8b29acf2b950b38f6927bb0429fa116c2e4cb02cd0858ce7c24e3d511ce94eb685eeb6131598cf86a403a6321

  • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

    Filesize

    223KB

    MD5

    1d417f92be7a5a2c5bb3b1897e152695

    SHA1

    ed31727207fe529f94a21c8163c97c908775a249

    SHA256

    8c535c92d33c79f06c0af6eb00a6b4ef0dac7bbdcef26aeea629d15e51f0c7ef

    SHA512

    34049c1168f729f1dbc1b58f487fa16c5730ced8b29acf2b950b38f6927bb0429fa116c2e4cb02cd0858ce7c24e3d511ce94eb685eeb6131598cf86a403a6321

  • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe.config

    Filesize

    690B

    MD5

    bca0ea75b6940aa86960d7b9098a5998

    SHA1

    3d57f82158ac72c7eb2e72ba19a80485d8103130

    SHA256

    5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

    SHA512

    260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

  • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\e97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

    Filesize

    223KB

    MD5

    128e8c7b314ac671a94e69f37d2c1f78

    SHA1

    e8100a7d109605ec52babb8c8db1ecf5a3ffa952

    SHA256

    22d90ebb68dfea9f56bdcbf9909e226e7f4978371b2b28eba044f68fa652558e

    SHA512

    002de39a566cbb11873c9a6adcee8901acce240c080feb5c52f799f377654beff9bf2d634e30cb1b345b4f54260048198b2d2c3aaf549d554f124d7cc92b6087

  • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\installer.exe

    Filesize

    699KB

    MD5

    c872c970f3490e1a5cec665ced0a5e9b

    SHA1

    42c6e3bde1c74bbfe294b73f9c014cbe9b4a6a32

    SHA256

    97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14

    SHA512

    e1c7d587b20410d7dcf7fd69766a5f21b77265435228c6a88b385f3bb31bb5caf812c0519aa9ca3dfcc861c1c8d3dd3d6a6ffba2f4565cb6b366fae40b67ccda

  • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe

    Filesize

    21KB

    MD5

    ae93c3a8315679a5fb24db3fe04e750c

    SHA1

    31a5a7a50040fea708aef69df0429ecf3d6054bd

    SHA256

    3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

    SHA512

    01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

  • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe

    Filesize

    21KB

    MD5

    ae93c3a8315679a5fb24db3fe04e750c

    SHA1

    31a5a7a50040fea708aef69df0429ecf3d6054bd

    SHA256

    3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

    SHA512

    01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

  • C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe.config

    Filesize

    359B

    MD5

    05a59e8e79546860cf1e351e32e69404

    SHA1

    aef4ad7bcbd79f99feb7100f05938721f12f7dce

    SHA256

    a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

    SHA512

    6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

  • \Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

    Filesize

    223KB

    MD5

    1d417f92be7a5a2c5bb3b1897e152695

    SHA1

    ed31727207fe529f94a21c8163c97c908775a249

    SHA256

    8c535c92d33c79f06c0af6eb00a6b4ef0dac7bbdcef26aeea629d15e51f0c7ef

    SHA512

    34049c1168f729f1dbc1b58f487fa16c5730ced8b29acf2b950b38f6927bb0429fa116c2e4cb02cd0858ce7c24e3d511ce94eb685eeb6131598cf86a403a6321

  • \Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe

    Filesize

    21KB

    MD5

    ae93c3a8315679a5fb24db3fe04e750c

    SHA1

    31a5a7a50040fea708aef69df0429ecf3d6054bd

    SHA256

    3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

    SHA512

    01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

  • \Users\Admin\AppData\Local\Temp\nsyCD9D.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • memory/796-71-0x000007FEF3D60000-0x000007FEF4783000-memory.dmp

    Filesize

    10.1MB

  • memory/796-73-0x0000000001EE6000-0x0000000001F05000-memory.dmp

    Filesize

    124KB

  • memory/796-72-0x000007FEF2A80000-0x000007FEF3B16000-memory.dmp

    Filesize

    16.6MB

  • memory/832-54-0x0000000075291000-0x0000000075293000-memory.dmp

    Filesize

    8KB

  • memory/832-56-0x00000000740C1000-0x00000000740C3000-memory.dmp

    Filesize

    8KB

  • memory/1744-65-0x0000000073A00000-0x0000000073FAB000-memory.dmp

    Filesize

    5.7MB

  • memory/1744-63-0x0000000073A00000-0x0000000073FAB000-memory.dmp

    Filesize

    5.7MB