Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 22:41

General

  • Target

    b18390379edd4004768c90192400990dd46dccd871d5cbe2587376427d36cf59.exe

  • Size

    148KB

  • MD5

    b5d479b6e7bb391eda68aaaa5d7f0b7d

  • SHA1

    1d89b39184ba90acc53a45313d1c952e9a2b6b72

  • SHA256

    b18390379edd4004768c90192400990dd46dccd871d5cbe2587376427d36cf59

  • SHA512

    e96708cd537d998ee8ae09c12282f30cff6b5ab2a10cde676fc0a970fbb8d540f42769e9d5653a01bb6a37f88b4db9ef1501eb51b10fdf6874f33220d84882a1

  • SSDEEP

    3072:PvkHeR+EFg/d/5Zznc4Dl5EDSgWsNBDCQ7RgDM37CtBwoIfuS1:PcHeR+YW5ZY8l5Tkl6DMLCBg

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b18390379edd4004768c90192400990dd46dccd871d5cbe2587376427d36cf59.exe
    "C:\Users\Admin\AppData\Local\Temp\b18390379edd4004768c90192400990dd46dccd871d5cbe2587376427d36cf59.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:1104

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1104-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

    Filesize

    8KB