Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 07:41

General

  • Target

    b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe

  • Size

    64KB

  • MD5

    bbb2750f399b2cbc8f2de9649c58772b

  • SHA1

    2269d16ab10fdf3187014c60292338c68b26f76c

  • SHA256

    b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae

  • SHA512

    96e40e540510bb8334d2065b2c889240502677b46f750b57234f4efd3d34bf13639c8c3eb0452bcdab73b5ac9bbbede1f86d8abffac8f05a35f527a5f1fad2ae

  • SSDEEP

    1536:xET64WKch3dQzOwtwSI3yHBUJu5OXIvzpjIp/n:xq64Wx3dmqSSyHBknGzpjA/n

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe
    "C:\Users\Admin\AppData\Local\Temp\b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Pvz..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:1704

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Pvz..bat

    Filesize

    274B

    MD5

    d9305a1b8b55c52f80f06b23f0cf5cb9

    SHA1

    4a33834bf0fc295a6b373d17259afc125b9625c8

    SHA256

    3d90f259bcc7f14722f35c40d9e2171f207fa8b5df1ea682c466369bc2332e60

    SHA512

    0f675f85c08988268c45f496871db502f0a48f0690a6c9f660d62e022817f5e302e6adb6c3f76a1ba1849c745e10ef91487654bb8dbf37dba29dfdb42f3045ce

  • memory/1708-54-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1708-55-0x0000000075111000-0x0000000075113000-memory.dmp

    Filesize

    8KB

  • memory/1708-56-0x00000000001C0000-0x00000000001D8000-memory.dmp

    Filesize

    96KB

  • memory/1708-57-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1708-59-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB