Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 14:22
Static task
static1
Behavioral task
behavioral1
Sample
adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe
Resource
win10v2004-20220812-en
General
-
Target
adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe
-
Size
180KB
-
MD5
c270461a4d5c3fe1bc5d7c323a9e9be7
-
SHA1
94a373197993fe70cb4c938800c474e5e9e7bd15
-
SHA256
adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935
-
SHA512
6f6cefd52ff88f20f632da7f2a4d682d3f0b4f4c9317590c0d84a5e41ccd69f2d30e20b4f61717a4839024f5334b93d1744c1c22369fa43f07c5f6fe1d0afecf
-
SSDEEP
1536:A4CU+8uOZdegVb+sUmgj7lnb+oXMfGfHan89lG:AxU+8/ZFisUhjxn2fGf6D
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/852-56-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/852-58-0x0000000000400000-0x0000000000440000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 932 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 852 adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 852 wrote to memory of 932 852 adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe 27 PID 852 wrote to memory of 932 852 adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe 27 PID 852 wrote to memory of 932 852 adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe 27 PID 852 wrote to memory of 932 852 adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe"C:\Users\Admin\AppData\Local\Temp\adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Klf..bat" > nul 2> nul2⤵
- Deletes itself
PID:932
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274B
MD5b4302bf7c482202d9d0ef1ae55b6c32e
SHA115d2678d10cef099a79a31a66081852a412cb1cb
SHA256615df2b214340fe2752add9c7dd4088b3ce724a3a9f3c72390ff3a545dd1edc3
SHA512f4703fab378724c0bc1d5386a76746e4e39ff6426d718280e31616059467a73c3c9d2c27f58c583c40f75ea7762461b27adf8bbfe5bed253974b349230aaeeca