Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 15:25

General

  • Target

    347740279a4355bd88dc3010554d48d6282ea58806fcd6ddc8cf53d05608a13f.exe

  • Size

    2.4MB

  • MD5

    ef74344c5d624d2104b9c48a988590c2

  • SHA1

    dfb06c73812bba65f39fd3932ee813a280f02397

  • SHA256

    347740279a4355bd88dc3010554d48d6282ea58806fcd6ddc8cf53d05608a13f

  • SHA512

    5fdacd928be2e5a3e42e7bb7e60295a8c6349a1085c6c862b1499eb129b974dff8421c23ee4763909f0ee2c0a6e9980141bed095142e251f7cc68103df6ec0be

  • SSDEEP

    24576:QI5DiFaGia+0TedS4TqeCOuA/CMT/Pk+KXZth4O9/7Xgw6WvnIrKMBbIb3+oTfpv:QFAoe9DuAKMTji4ONPmrIfvRbJ2Sh

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\347740279a4355bd88dc3010554d48d6282ea58806fcd6ddc8cf53d05608a13f.exe
    "C:\Users\Admin\AppData\Local\Temp\347740279a4355bd88dc3010554d48d6282ea58806fcd6ddc8cf53d05608a13f.exe"
    1⤵
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /DNF.exe.manifest
      2⤵
      • Kills process with taskkill
      PID:916

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1000-54-0x0000000076561000-0x0000000076563000-memory.dmp

    Filesize

    8KB