Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 09:14

General

  • Target

    95bb8251be6322eb6a7335c75bff90d5886d5e864afea1113010af214d021f9a.exe

  • Size

    2.7MB

  • MD5

    d550542742bb0ffb941a0c9bb304b6ec

  • SHA1

    550b369fd652716b621404e3b8e80128e0645daf

  • SHA256

    95bb8251be6322eb6a7335c75bff90d5886d5e864afea1113010af214d021f9a

  • SHA512

    b26f2095ba1b942ec34aae77ac3170341da2fc40c509386274d7675febfc8a7cfd1fe5398e2953b9cbe865a99194636086f9bb4a3a3cd5b6c7322ca3f48fc2a1

  • SSDEEP

    49152:QewXKGWntkFNRmSxKO04mjaGhgDVBwIB8Ao93LKgFxu9moIsjb1qbdj:dOFvpMOzmj/hCBwIB8Ao93L/Fxu9moIJ

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95bb8251be6322eb6a7335c75bff90d5886d5e864afea1113010af214d021f9a.exe
    "C:\Users\Admin\AppData\Local\Temp\95bb8251be6322eb6a7335c75bff90d5886d5e864afea1113010af214d021f9a.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1228-54-0x0000000075561000-0x0000000075563000-memory.dmp

    Filesize

    8KB

  • memory/1228-55-0x0000000000400000-0x0000000000814000-memory.dmp

    Filesize

    4.1MB

  • memory/1228-56-0x0000000002220000-0x00000000023A1000-memory.dmp

    Filesize

    1.5MB

  • memory/1228-58-0x000000000092E000-0x0000000000976000-memory.dmp

    Filesize

    288KB

  • memory/1228-59-0x0000000074EB0000-0x0000000074EF7000-memory.dmp

    Filesize

    284KB

  • memory/1228-60-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-61-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-62-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-63-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-66-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-65-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-64-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-67-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-70-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-71-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-69-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-68-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-75-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-74-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-73-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-72-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-77-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-78-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-81-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-80-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-83-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-82-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-79-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-76-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-86-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-87-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-85-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-91-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-93-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-94-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-95-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-96-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-92-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-97-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-99-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-98-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-102-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-103-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-101-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-100-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-90-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-89-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-88-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-106-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-105-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-104-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-111-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-112-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-110-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-117-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-120-0x0000000077090000-0x0000000077210000-memory.dmp

    Filesize

    1.5MB

  • memory/1228-119-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-118-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-116-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-115-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-114-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-113-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-109-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-108-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-107-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-84-0x00000000008EC000-0x0000000000930000-memory.dmp

    Filesize

    272KB

  • memory/1228-1019-0x0000000002220000-0x00000000023A1000-memory.dmp

    Filesize

    1.5MB

  • memory/1228-2365-0x00000000023B0000-0x00000000024B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1228-2367-0x000000000092E000-0x0000000000976000-memory.dmp

    Filesize

    288KB

  • memory/1228-2366-0x0000000000904000-0x0000000000921000-memory.dmp

    Filesize

    116KB

  • memory/1228-2372-0x0000000000400000-0x0000000000814000-memory.dmp

    Filesize

    4.1MB

  • memory/1228-2373-0x00000000020E0000-0x0000000002181000-memory.dmp

    Filesize

    644KB

  • memory/1228-2374-0x0000000000904000-0x0000000000921000-memory.dmp

    Filesize

    116KB

  • memory/1228-2375-0x000000000092E000-0x0000000000976000-memory.dmp

    Filesize

    288KB

  • memory/1228-2376-0x0000000000400000-0x0000000000814000-memory.dmp

    Filesize

    4.1MB