Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe
Resource
win10v2004-20221111-en
General
-
Target
f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe
-
Size
116KB
-
MD5
01f01910e9b8142a23a093478b8b54f2
-
SHA1
baf16ef92c4065e2ac9ab6cf3f87ebc36eb71fa5
-
SHA256
f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c
-
SHA512
f89fe751b8d3ca5d029273f212dc1ac3a2f08598b2772b4e698ce3582a73d4dae4ebb8607bd714a8c7d2934c56c61f34abfdb1169ce0abbf013333a4136f6223
-
SSDEEP
1536:nyuNt9gDpbEOEiDfowwqcQgduffFYfOv:yimhEOEiDfoLqcJefFb
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1808 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1560 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1560 tasklist.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1752 f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe 1752 f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1808 1752 f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe 30 PID 1752 wrote to memory of 1808 1752 f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe 30 PID 1752 wrote to memory of 1808 1752 f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe 30 PID 1752 wrote to memory of 1808 1752 f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe 30 PID 1808 wrote to memory of 1560 1808 cmd.exe 32 PID 1808 wrote to memory of 1560 1808 cmd.exe 32 PID 1808 wrote to memory of 1560 1808 cmd.exe 32 PID 1808 wrote to memory of 1560 1808 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe"C:\Users\Admin\AppData\Local\Temp\f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del f54ee44b82a2676f9c55454335369ca3edec89d42cde7a5be351befe72c2238c.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-