Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 00:10

General

  • Target

    a21361e083c35f09ec43d92b58f936231df9add9f6cafd9b77c1e2693aa78cba.exe

  • Size

    6.6MB

  • MD5

    94c797826e8d589095fc64f81d9a2009

  • SHA1

    84a56f8fad32e59a048657114bd989b68d5a376d

  • SHA256

    a21361e083c35f09ec43d92b58f936231df9add9f6cafd9b77c1e2693aa78cba

  • SHA512

    dd9693765bc460a1105721bce19fade8706875ad0ae9add30a8c933eb1f1b6c7c24af9a285b8cac3e70447f922d8a82bb3dc4a4565830f84751583c733e79676

  • SSDEEP

    98304:iH4OMA+IgeyBYJw19PpGMPUQHsu/fBnfvLfdAMOc22y9:ZOMXGQF/fF3Lle

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a21361e083c35f09ec43d92b58f936231df9add9f6cafd9b77c1e2693aa78cba.exe
    "C:\Users\Admin\AppData\Local\Temp\a21361e083c35f09ec43d92b58f936231df9add9f6cafd9b77c1e2693aa78cba.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Users\Admin\AppData\Local\Temp\a21361e083c35f09ec43d92b58f936231df9add9f6cafd9b77c1e2693aa78cba.exe
      "C:\Users\Admin\AppData\Local\Temp\a21361e083c35f09ec43d92b58f936231df9add9f6cafd9b77c1e2693aa78cba.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:3792

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3792-133-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

  • memory/3792-134-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

  • memory/3792-135-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB