Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    250s
  • max time network
    336s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 20:51

General

  • Target

    832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe

  • Size

    30KB

  • MD5

    72070d73697bf0654b0fd0945145dba4

  • SHA1

    00b5ffca350d130925ebca21c680f600eeaf6b3d

  • SHA256

    832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2

  • SHA512

    7cee6e0f9607bbc029ada3befb08e7816fb467f25b7059bb26dc6d4aff8b3a83b00f1b5d4166729fa98ccf56119b36f11283909b24a2de2c514ea6da82ec8402

  • SSDEEP

    384:qnIzTqDPuZ/guOipqmQUzoOaE4WXmeqCkAn1gfothwd6uAZvSdx691kxQ8623lel:q2qDPncqmVtHW0nBtrZvSdA9CxQo1A

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe
    "C:\Users\Admin\AppData\Local\Temp\832863ece8c7eced9395b8929b1557297feab33f8912210e8ff870ed849baab2.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO DECRYPT FILES.txt
      2⤵
        PID:1364

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\HOW TO DECRYPT FILES.txt

      Filesize

      1KB

      MD5

      e7c9d74ed45132eb6bbe2457d6d8b5e9

      SHA1

      dce71d933878c0ac0140d968ba695c3d9db1b1b0

      SHA256

      861fa41190282a7510a70eb90cf558817e6731e68ef55246fa67dc0c1c8df1fc

      SHA512

      9435dbe2bf75eca50bf38cbd40d82e2764d3a9b843cc480adfc539250d232b62920eeb5ef68a1316152f3ef1c5d17b80e2f44bd112f59acc50ab10723fa82f5a

    • memory/940-54-0x0000000076391000-0x0000000076393000-memory.dmp

      Filesize

      8KB

    • memory/940-55-0x0000000000400000-0x0000000000425000-memory.dmp

      Filesize

      148KB

    • memory/940-56-0x0000000000220000-0x0000000000223000-memory.dmp

      Filesize

      12KB

    • memory/940-57-0x0000000000400000-0x0000000000425000-memory.dmp

      Filesize

      148KB

    • memory/940-58-0x0000000000400000-0x0000000000425000-memory.dmp

      Filesize

      148KB