Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
29/11/2022, 15:12
General
-
Target
547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe
-
Size
4.6MB
-
MD5
b732e893505b753a9c2d8bdb16bce4a0
-
SHA1
8eda3b9dae91d58e9c6fd36d923319c755df91ca
-
SHA256
547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422
-
SHA512
c6cfaaf2d504f60f8c799613bcad3023a974412670874c4d48f909d2245791bbccff69348e4e6a5c9f7a32dae5ecbfe9cceec3e8836d24fa62970732d0ca68ae
-
SSDEEP
98304:i1WVabJDxrp6S6elUavr28/gpjFOQ6LxLZa6Sjy+58Rq:UAabJDzD68EOd7u2+5Mq
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe"C:\Users\Admin\AppData\Local\Temp\547f202390277b7fb33c12994130f2044748dfab34ee2cb5d4996f5b062a0422.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Tempps.exe"C:\Users\Admin\AppData\Local\Tempps.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EJE49.tmp\Tempps.tmp"C:\Users\Admin\AppData\Local\Temp\is-EJE49.tmp\Tempps.tmp" /SL5="$10172,4379801,140800,C:\Users\Admin\AppData\Local\Tempps.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5b277e6ac242fcbc37f4d03e1528949c1
SHA12602407044a6bad216d3856eaf8fb990e0f1094f
SHA2569461ae8a13a57c0d8490916dc1e1bb20cb0c171b9852d0846a03c4c4d212f204
SHA51280d8b934ff63e4a7df3dabb9e6435c2d5ea542624b238be8a27b53c63be8dc244d46d4d9db1950b6d67d91dde12f3d819e7e4453536595d6385c65d2c6bbf5f7
-
Filesize
4.6MB
MD53cd222f47bf2de25c721fd8b1fa965e0
SHA1d5b087759639020ad5d8d900145efe978e80eadd
SHA256c8cb41f7f9db8f764daf601f7f56daf9514eede1e1d42e4039492663e7dc8171
SHA5125a13be5a7a1a871eaf7ca8ecb7659cb3c5e90657752baae80026abf607dc93fdac45069631aae1f8ac6a43968adcdfb4df4f591911258e59a1a47219cdde5193
-
Filesize
4.6MB
MD53cd222f47bf2de25c721fd8b1fa965e0
SHA1d5b087759639020ad5d8d900145efe978e80eadd
SHA256c8cb41f7f9db8f764daf601f7f56daf9514eede1e1d42e4039492663e7dc8171
SHA5125a13be5a7a1a871eaf7ca8ecb7659cb3c5e90657752baae80026abf607dc93fdac45069631aae1f8ac6a43968adcdfb4df4f591911258e59a1a47219cdde5193
-
Filesize
1.1MB
MD5b277e6ac242fcbc37f4d03e1528949c1
SHA12602407044a6bad216d3856eaf8fb990e0f1094f
SHA2569461ae8a13a57c0d8490916dc1e1bb20cb0c171b9852d0846a03c4c4d212f204
SHA51280d8b934ff63e4a7df3dabb9e6435c2d5ea542624b238be8a27b53c63be8dc244d46d4d9db1950b6d67d91dde12f3d819e7e4453536595d6385c65d2c6bbf5f7
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
4.6MB
MD53cd222f47bf2de25c721fd8b1fa965e0
SHA1d5b087759639020ad5d8d900145efe978e80eadd
SHA256c8cb41f7f9db8f764daf601f7f56daf9514eede1e1d42e4039492663e7dc8171
SHA5125a13be5a7a1a871eaf7ca8ecb7659cb3c5e90657752baae80026abf607dc93fdac45069631aae1f8ac6a43968adcdfb4df4f591911258e59a1a47219cdde5193
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
5.7MB