Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 17:56
Behavioral task
behavioral1
Sample
94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe
Resource
win7-20220812-en
General
-
Target
94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe
-
Size
588KB
-
MD5
50ba9d48b90e13317575a6ce80dd057d
-
SHA1
39dbd8254fb726862aec59ba1985f5c8aa249720
-
SHA256
94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe
-
SHA512
37800e551b819a9b0e393042bedad8aaecc02bf2fd2210c61d49f72d3b613ee19f5aed2626a2849668f102d573d56ddfc67f9acb047c8b8eecf25201af0e6fae
-
SSDEEP
12288:l8m/nOShJg3wdlfZlpslDE79kvvid7Q02oSQh57Z4V8WU2iXr8FO:l8m/nXhJkwbhlpslD3vo7YoSQT7WG2ir
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1908-54-0x0000000000400000-0x0000000000521000-memory.dmp upx behavioral1/memory/1908-57-0x0000000000400000-0x0000000000521000-memory.dmp upx behavioral1/files/0x00080000000146e3-58.dat upx behavioral1/memory/1908-62-0x0000000000400000-0x0000000000521000-memory.dmp upx behavioral1/memory/1908-63-0x0000000000400000-0x0000000000521000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1908 94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~2\is7081914.log 94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main 94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1908 94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe 1908 94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe"C:\Users\Admin\AppData\Local\Temp\94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\ICReinstall_94da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe.exe
Filesize588KB
MD550ba9d48b90e13317575a6ce80dd057d
SHA139dbd8254fb726862aec59ba1985f5c8aa249720
SHA25694da1c8dca2ad28c2bbdf7c594ab75a47ae776e08396c9a12b33a10b66b72afe
SHA51237800e551b819a9b0e393042bedad8aaecc02bf2fd2210c61d49f72d3b613ee19f5aed2626a2849668f102d573d56ddfc67f9acb047c8b8eecf25201af0e6fae