Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

ac72ba9b9f...ee.exe

windows7-x64

4

ac72ba9b9f...ee.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 15:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe

  • Size

    908KB

  • MD5

    29bea19331f3cc3ea9df51ad081d70ab

  • SHA1

    ceadab9a23fc578caeb44ffcd46bb619d45f482b

  • SHA256

    ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee

  • SHA512

    413f9a491d1a710107fcb5baa465cfb51b6f3a0d55b25144940afba43b69f3c7767647ce9a55fc0e4625b0a96f8b4c24dfd38ec99a10697be2fa7a7f749e1869

  • SSDEEP

    12288:QcQgCJcyk4S6QesXwuwMZnEGWzjcIEZXL4LUYCok7rA7WU+KGt9dUX:QNcyk44DAOWzv+p1yMzdUX

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe
    "C:\Users\Admin\AppData\Local\Temp\ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe
      "C:\Users\Admin\AppData\Local\Temp\ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe" C:\Users\Admin\AppData\Local\Temp\ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Users\Admin\AppData\Local\Temp\ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe
        "C:\Users\Admin\AppData\Local\Temp\ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe" C:\Users\Admin\AppData\Local\Temp\ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe" C:\Users\Admin\AppData\Local\Temp\ac72ba9b9f9e7c32dacc9aab2c6f651163acbf6013aabd2691e28553d2e08aee.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1932

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1544-54-0x0000000075611000-0x0000000075613000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-55-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

    Download