Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
Resource
win10v2004-20221111-en
General
-
Target
6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
-
Size
794KB
-
MD5
fbaa69c44cf521e048bd775727783259
-
SHA1
75e112f724247375b327709b33956ff518597e07
-
SHA256
6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d
-
SHA512
71c8f10a4aef10e5bff25c60a1b266440dae8d5e97bb35c33e340235ca1cf0b27b3542fdb83a0764466b4356fb1d99c63808fd9c218d0318821248b82eebc56c
-
SSDEEP
24576:4ueAYT/hmflRBmqPeQ93D4AQqRRdfcj4wMn0DVooC+W:4uCTsdRBZbDxQqRRdfc3MncVoD+W
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 940 launch.exe 1756 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe -
Loads dropped DLL 2 IoCs
pid Process 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x000800000001232e-73.dat nsis_installer_1 behavioral1/files/0x000800000001232e-73.dat nsis_installer_2 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1756 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 1756 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1488 wrote to memory of 940 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 28 PID 1488 wrote to memory of 940 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 28 PID 1488 wrote to memory of 940 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 28 PID 1488 wrote to memory of 940 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 28 PID 1488 wrote to memory of 940 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 28 PID 1488 wrote to memory of 940 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 28 PID 1488 wrote to memory of 940 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 28 PID 1488 wrote to memory of 1756 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 29 PID 1488 wrote to memory of 1756 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 29 PID 1488 wrote to memory of 1756 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 29 PID 1488 wrote to memory of 1756 1488 6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe"C:\Users\Admin\AppData\Local\Temp\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exeC:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe "e6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe" "6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe" "3b58bf0f691b4f20b2d34b2b6f203603" dec2⤵
- Executes dropped EXE
PID:940
-
-
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exeC:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe /path="C:\Users\Admin\AppData\Local\Temp\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1756
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
Filesize325KB
MD568c21b1d783650d0f2b55f351f441283
SHA1008873cbe3713a1f50fa82e96da0fd742192e73b
SHA2565e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15
SHA5122152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86
-
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
Filesize325KB
MD568c21b1d783650d0f2b55f351f441283
SHA1008873cbe3713a1f50fa82e96da0fd742192e73b
SHA2565e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15
SHA5122152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86
-
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe.config
Filesize690B
MD5bca0ea75b6940aa86960d7b9098a5998
SHA13d57f82158ac72c7eb2e72ba19a80485d8103130
SHA2565a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d
SHA512260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3
-
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\e6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
Filesize325KB
MD513ee1c03daec55875db9808cebbfff5d
SHA1e182704191ee3277c20d73d5d47a3774d8c978a8
SHA256134887182a71915571ba2b5d8a9767f7008bd2282c7a123eab9816ade8290d0d
SHA51236c40cd26a4106c173851095234515c99d49882993f74c2249436bf21b1a7a922d6a2284e6b063f4857ec24678d12e22fc2b40e642e60ffb266a32fd577b22c2
-
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\installer.exe
Filesize794KB
MD5fbaa69c44cf521e048bd775727783259
SHA175e112f724247375b327709b33956ff518597e07
SHA2566df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d
SHA51271c8f10a4aef10e5bff25c60a1b266440dae8d5e97bb35c33e340235ca1cf0b27b3542fdb83a0764466b4356fb1d99c63808fd9c218d0318821248b82eebc56c
-
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
Filesize21KB
MD5ae93c3a8315679a5fb24db3fe04e750c
SHA131a5a7a50040fea708aef69df0429ecf3d6054bd
SHA2563207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398
SHA51201120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd
-
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
Filesize21KB
MD5ae93c3a8315679a5fb24db3fe04e750c
SHA131a5a7a50040fea708aef69df0429ecf3d6054bd
SHA2563207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398
SHA51201120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd
-
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe.config
Filesize359B
MD505a59e8e79546860cf1e351e32e69404
SHA1aef4ad7bcbd79f99feb7100f05938721f12f7dce
SHA256a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430
SHA5126ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa
-
\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
Filesize325KB
MD568c21b1d783650d0f2b55f351f441283
SHA1008873cbe3713a1f50fa82e96da0fd742192e73b
SHA2565e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15
SHA5122152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86
-
\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
Filesize21KB
MD5ae93c3a8315679a5fb24db3fe04e750c
SHA131a5a7a50040fea708aef69df0429ecf3d6054bd
SHA2563207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398
SHA51201120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd