Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 23:36
Static task
static1
Behavioral task
behavioral1
Sample
5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe
Resource
win10v2004-20221111-en
General
-
Target
5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe
-
Size
306KB
-
MD5
51b5fede0b362b530cf40a08f15ba098
-
SHA1
a1dcb7c431eb729a5c7ebd92092abf491e19698f
-
SHA256
5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9
-
SHA512
92c5e8625ffee6289a3a709db868608c7acdac202b936cbfff86655064085f2cf54b7cf4e7efaab7761ad820f152752fe30b94782ce91c65c356011c8c5625e2
-
SSDEEP
6144:fg/ksvhuWTcdnScMJh7lD69drYrMfQicCS28534I4r8c:V/MJ36aMfQ1A85oI4Qc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1676 google.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 616 netsh.exe -
Loads dropped DLL 1 IoCs
pid Process 1488 5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\85ce27c90f0ba2b98ceb888e2ca7acde = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .." google.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\85ce27c90f0ba2b98ceb888e2ca7acde = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .." google.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe 1676 google.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1676 google.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1676 1488 5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe 26 PID 1488 wrote to memory of 1676 1488 5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe 26 PID 1488 wrote to memory of 1676 1488 5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe 26 PID 1488 wrote to memory of 1676 1488 5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe 26 PID 1676 wrote to memory of 616 1676 google.exe 27 PID 1676 wrote to memory of 616 1676 google.exe 27 PID 1676 wrote to memory of 616 1676 google.exe 27 PID 1676 wrote to memory of 616 1676 google.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe"C:\Users\Admin\AppData\Local\Temp\5afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\google.exe"C:\Users\Admin\AppData\Local\Temp\google.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\google.exe" "google.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:616
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306KB
MD551b5fede0b362b530cf40a08f15ba098
SHA1a1dcb7c431eb729a5c7ebd92092abf491e19698f
SHA2565afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9
SHA51292c5e8625ffee6289a3a709db868608c7acdac202b936cbfff86655064085f2cf54b7cf4e7efaab7761ad820f152752fe30b94782ce91c65c356011c8c5625e2
-
Filesize
306KB
MD551b5fede0b362b530cf40a08f15ba098
SHA1a1dcb7c431eb729a5c7ebd92092abf491e19698f
SHA2565afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9
SHA51292c5e8625ffee6289a3a709db868608c7acdac202b936cbfff86655064085f2cf54b7cf4e7efaab7761ad820f152752fe30b94782ce91c65c356011c8c5625e2
-
Filesize
306KB
MD551b5fede0b362b530cf40a08f15ba098
SHA1a1dcb7c431eb729a5c7ebd92092abf491e19698f
SHA2565afada6de45af6f133aac68797942053e0a2950bb1b04cba4f0dc02fc82111c9
SHA51292c5e8625ffee6289a3a709db868608c7acdac202b936cbfff86655064085f2cf54b7cf4e7efaab7761ad820f152752fe30b94782ce91c65c356011c8c5625e2