Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    44s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 14:22

General

  • Target

    adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe

  • Size

    180KB

  • MD5

    c270461a4d5c3fe1bc5d7c323a9e9be7

  • SHA1

    94a373197993fe70cb4c938800c474e5e9e7bd15

  • SHA256

    adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935

  • SHA512

    6f6cefd52ff88f20f632da7f2a4d682d3f0b4f4c9317590c0d84a5e41ccd69f2d30e20b4f61717a4839024f5334b93d1744c1c22369fa43f07c5f6fe1d0afecf

  • SSDEEP

    1536:A4CU+8uOZdegVb+sUmgj7lnb+oXMfGfHan89lG:AxU+8/ZFisUhjxn2fGf6D

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe
    "C:\Users\Admin\AppData\Local\Temp\adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Klf..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:932

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Klf..bat

    Filesize

    274B

    MD5

    b4302bf7c482202d9d0ef1ae55b6c32e

    SHA1

    15d2678d10cef099a79a31a66081852a412cb1cb

    SHA256

    615df2b214340fe2752add9c7dd4088b3ce724a3a9f3c72390ff3a545dd1edc3

    SHA512

    f4703fab378724c0bc1d5386a76746e4e39ff6426d718280e31616059467a73c3c9d2c27f58c583c40f75ea7762461b27adf8bbfe5bed253974b349230aaeeca

  • memory/852-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

    Filesize

    8KB

  • memory/852-55-0x0000000000220000-0x0000000000223000-memory.dmp

    Filesize

    12KB

  • memory/852-56-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/852-58-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB