Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    35s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 10:42

General

  • Target

    05f4d80acbe657f195228faf87b9723922790b170a9b6aa14d193553f1bbd46b.exe

  • Size

    21.9MB

  • MD5

    d215f379a6d1946afd9376c92857c2a3

  • SHA1

    975a3f866fa0ce1b8aa24c04372433c99c98f0f2

  • SHA256

    05f4d80acbe657f195228faf87b9723922790b170a9b6aa14d193553f1bbd46b

  • SHA512

    4b5e95c1abb437c052444d829ef60d37163622d1d4c92b6a567a0099047eb05b33ed03149a0547aef13fd8fcefa705346bcd2859f31f78a3056c831890198bac

  • SSDEEP

    49152:Ycy52F1B2TDCbZ6MFhQjzCHrx50nxk6NKa:Yc/gM7Q/CuNKa

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05f4d80acbe657f195228faf87b9723922790b170a9b6aa14d193553f1bbd46b.exe
    "C:\Users\Admin\AppData\Local\Temp\05f4d80acbe657f195228faf87b9723922790b170a9b6aa14d193553f1bbd46b.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Windows\SysWOW64\Net.exe
      Net Stop PcaSvc
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 Stop PcaSvc
        3⤵
          PID:1744
      • C:\Users\Admin\AppData\Local\Temp\g82878\3ddown.com_eclstar4_setup.exe
        C:\Users\Admin\AppData\Local\Temp\g82878\3ddown.com_eclstar4_setup.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:436
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x56c
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:320

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\g82878\3ddown.com_eclstar4_setup.exe

      Filesize

      126KB

      MD5

      917caf28d774062ce6a539362d5270a1

      SHA1

      f08d51cd5292325578227225af43025cc8948c82

      SHA256

      bf82b2b66442a3387bd6aceb1999595a6419f35da8a07d76986a4b995d56fabd

      SHA512

      5721f5057b8776862ab58fb614bb6cb2dac2dd14aaa9548a2402078d97b2e20ae6ad53ea860b13e49bebafb7ebb3cbc81f61c5d9e9b6813d50605780c1446849

    • C:\Users\Admin\AppData\Local\Temp\g82878\3ddown.com_eclstar4_setup.exe

      Filesize

      126KB

      MD5

      917caf28d774062ce6a539362d5270a1

      SHA1

      f08d51cd5292325578227225af43025cc8948c82

      SHA256

      bf82b2b66442a3387bd6aceb1999595a6419f35da8a07d76986a4b995d56fabd

      SHA512

      5721f5057b8776862ab58fb614bb6cb2dac2dd14aaa9548a2402078d97b2e20ae6ad53ea860b13e49bebafb7ebb3cbc81f61c5d9e9b6813d50605780c1446849

    • \Users\Admin\AppData\Local\Temp\g82878\3ddown.com_eclstar4_setup.exe

      Filesize

      126KB

      MD5

      917caf28d774062ce6a539362d5270a1

      SHA1

      f08d51cd5292325578227225af43025cc8948c82

      SHA256

      bf82b2b66442a3387bd6aceb1999595a6419f35da8a07d76986a4b995d56fabd

      SHA512

      5721f5057b8776862ab58fb614bb6cb2dac2dd14aaa9548a2402078d97b2e20ae6ad53ea860b13e49bebafb7ebb3cbc81f61c5d9e9b6813d50605780c1446849

    • \Users\Admin\AppData\Local\Temp\g82878\3ddown.com_eclstar4_setup.exe

      Filesize

      126KB

      MD5

      917caf28d774062ce6a539362d5270a1

      SHA1

      f08d51cd5292325578227225af43025cc8948c82

      SHA256

      bf82b2b66442a3387bd6aceb1999595a6419f35da8a07d76986a4b995d56fabd

      SHA512

      5721f5057b8776862ab58fb614bb6cb2dac2dd14aaa9548a2402078d97b2e20ae6ad53ea860b13e49bebafb7ebb3cbc81f61c5d9e9b6813d50605780c1446849

    • \Users\Admin\AppData\Local\Temp\g82878\3ddown.com_eclstar4_setup.exe

      Filesize

      126KB

      MD5

      917caf28d774062ce6a539362d5270a1

      SHA1

      f08d51cd5292325578227225af43025cc8948c82

      SHA256

      bf82b2b66442a3387bd6aceb1999595a6419f35da8a07d76986a4b995d56fabd

      SHA512

      5721f5057b8776862ab58fb614bb6cb2dac2dd14aaa9548a2402078d97b2e20ae6ad53ea860b13e49bebafb7ebb3cbc81f61c5d9e9b6813d50605780c1446849

    • \Users\Admin\AppData\Local\Temp\g82878\3ddown.com_eclstar4_setup.exe

      Filesize

      126KB

      MD5

      917caf28d774062ce6a539362d5270a1

      SHA1

      f08d51cd5292325578227225af43025cc8948c82

      SHA256

      bf82b2b66442a3387bd6aceb1999595a6419f35da8a07d76986a4b995d56fabd

      SHA512

      5721f5057b8776862ab58fb614bb6cb2dac2dd14aaa9548a2402078d97b2e20ae6ad53ea860b13e49bebafb7ebb3cbc81f61c5d9e9b6813d50605780c1446849

    • memory/1192-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

      Filesize

      8KB