Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 23:45

General

  • Target

    81a116e0142d7640750ad8dc5142a72855e5f488b62c872b0de41528b867a297.exe

  • Size

    56KB

  • MD5

    a54884e11d942683eb5bc4df7c13aef7

  • SHA1

    8ba5f506dcdeef904c73e89df7d08c4f29ef0821

  • SHA256

    81a116e0142d7640750ad8dc5142a72855e5f488b62c872b0de41528b867a297

  • SHA512

    04a8bc44617a3d648df11628ff5843f2eff99bf7c436bea11087d0e82ee831e159eeb1ca9b92e3f1ef683e4af3f7b507eb305a3d3800e8f238ada561111af6aa

  • SSDEEP

    768:c+HBPe1HHR4lCko8jf0mq/6/Q/9NF0+LEc8af3ts0E91:cl1HHRIocq2oS+Ljb3ts0E91

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81a116e0142d7640750ad8dc5142a72855e5f488b62c872b0de41528b867a297.exe
    "C:\Users\Admin\AppData\Local\Temp\81a116e0142d7640750ad8dc5142a72855e5f488b62c872b0de41528b867a297.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\filen.exe
      "C:\Users\Admin\filen.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1616

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\filen.exe

    Filesize

    56KB

    MD5

    0e162b353cf761718086520f774a3550

    SHA1

    42558c488de2792156a09b26fd4f3feb001ba23f

    SHA256

    799340e4e36f2307e8ce70c60e7476b561cc4b5b18e246df875ca5540beaa8ad

    SHA512

    5abf0022dbb7b56cde9db4b0ff24b6bd0629ba6a752fec1f0ef4069f59c39d480dd092e21377d221703345c881ef1a50b5d79ae6bb9f18ecdedb6d11440d0cbb

  • C:\Users\Admin\filen.exe

    Filesize

    56KB

    MD5

    0e162b353cf761718086520f774a3550

    SHA1

    42558c488de2792156a09b26fd4f3feb001ba23f

    SHA256

    799340e4e36f2307e8ce70c60e7476b561cc4b5b18e246df875ca5540beaa8ad

    SHA512

    5abf0022dbb7b56cde9db4b0ff24b6bd0629ba6a752fec1f0ef4069f59c39d480dd092e21377d221703345c881ef1a50b5d79ae6bb9f18ecdedb6d11440d0cbb

  • \Users\Admin\filen.exe

    Filesize

    56KB

    MD5

    0e162b353cf761718086520f774a3550

    SHA1

    42558c488de2792156a09b26fd4f3feb001ba23f

    SHA256

    799340e4e36f2307e8ce70c60e7476b561cc4b5b18e246df875ca5540beaa8ad

    SHA512

    5abf0022dbb7b56cde9db4b0ff24b6bd0629ba6a752fec1f0ef4069f59c39d480dd092e21377d221703345c881ef1a50b5d79ae6bb9f18ecdedb6d11440d0cbb

  • \Users\Admin\filen.exe

    Filesize

    56KB

    MD5

    0e162b353cf761718086520f774a3550

    SHA1

    42558c488de2792156a09b26fd4f3feb001ba23f

    SHA256

    799340e4e36f2307e8ce70c60e7476b561cc4b5b18e246df875ca5540beaa8ad

    SHA512

    5abf0022dbb7b56cde9db4b0ff24b6bd0629ba6a752fec1f0ef4069f59c39d480dd092e21377d221703345c881ef1a50b5d79ae6bb9f18ecdedb6d11440d0cbb

  • memory/1784-56-0x00000000751A1000-0x00000000751A3000-memory.dmp

    Filesize

    8KB