Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 16:53
Static task
static1
Behavioral task
behavioral1
Sample
975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe
Resource
win10v2004-20221111-en
General
-
Target
975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe
-
Size
299KB
-
MD5
75a01b1eef625ad760beed8a852b825e
-
SHA1
29319cd5b6b0fbde3570d0b5fd2ec231cefbafd5
-
SHA256
975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2
-
SHA512
0b71f6eb065f0cda2fe0190bb08b753f6d5f631dd72d3a38518ff1a4e7890f8e8a43060fae9ceaa002d8e2eedeadc694e019e48eb7aa8f05bbff401b45ab15f6
-
SSDEEP
6144:4xhdU2wDkeS4rIuMnmcuiFAeOPXYKYAP2BzC9dkYgTyhUg:4LwDk9mcui3OPotIrdpV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 820 ipsojzskgb.exe -
Deletes itself 1 IoCs
pid Process 884 cmd.exe -
Loads dropped DLL 3 IoCs
pid Process 884 cmd.exe 884 cmd.exe 820 ipsojzskgb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1536 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1832 PING.EXE -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1536 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe 820 ipsojzskgb.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 800 wrote to memory of 884 800 975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe 28 PID 800 wrote to memory of 884 800 975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe 28 PID 800 wrote to memory of 884 800 975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe 28 PID 800 wrote to memory of 884 800 975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe 28 PID 884 wrote to memory of 1536 884 cmd.exe 30 PID 884 wrote to memory of 1536 884 cmd.exe 30 PID 884 wrote to memory of 1536 884 cmd.exe 30 PID 884 wrote to memory of 1536 884 cmd.exe 30 PID 884 wrote to memory of 1832 884 cmd.exe 32 PID 884 wrote to memory of 1832 884 cmd.exe 32 PID 884 wrote to memory of 1832 884 cmd.exe 32 PID 884 wrote to memory of 1832 884 cmd.exe 32 PID 884 wrote to memory of 820 884 cmd.exe 33 PID 884 wrote to memory of 820 884 cmd.exe 33 PID 884 wrote to memory of 820 884 cmd.exe 33 PID 884 wrote to memory of 820 884 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe"C:\Users\Admin\AppData\Local\Temp\975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 800 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2.exe" & start C:\Users\Admin\AppData\Local\IPSOJZ~1.EXE -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 8003⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:1832
-
-
C:\Users\Admin\AppData\Local\ipsojzskgb.exeC:\Users\Admin\AppData\Local\IPSOJZ~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:820
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299KB
MD575a01b1eef625ad760beed8a852b825e
SHA129319cd5b6b0fbde3570d0b5fd2ec231cefbafd5
SHA256975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2
SHA5120b71f6eb065f0cda2fe0190bb08b753f6d5f631dd72d3a38518ff1a4e7890f8e8a43060fae9ceaa002d8e2eedeadc694e019e48eb7aa8f05bbff401b45ab15f6
-
Filesize
299KB
MD575a01b1eef625ad760beed8a852b825e
SHA129319cd5b6b0fbde3570d0b5fd2ec231cefbafd5
SHA256975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2
SHA5120b71f6eb065f0cda2fe0190bb08b753f6d5f631dd72d3a38518ff1a4e7890f8e8a43060fae9ceaa002d8e2eedeadc694e019e48eb7aa8f05bbff401b45ab15f6
-
Filesize
299KB
MD575a01b1eef625ad760beed8a852b825e
SHA129319cd5b6b0fbde3570d0b5fd2ec231cefbafd5
SHA256975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2
SHA5120b71f6eb065f0cda2fe0190bb08b753f6d5f631dd72d3a38518ff1a4e7890f8e8a43060fae9ceaa002d8e2eedeadc694e019e48eb7aa8f05bbff401b45ab15f6
-
Filesize
299KB
MD575a01b1eef625ad760beed8a852b825e
SHA129319cd5b6b0fbde3570d0b5fd2ec231cefbafd5
SHA256975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2
SHA5120b71f6eb065f0cda2fe0190bb08b753f6d5f631dd72d3a38518ff1a4e7890f8e8a43060fae9ceaa002d8e2eedeadc694e019e48eb7aa8f05bbff401b45ab15f6
-
Filesize
299KB
MD575a01b1eef625ad760beed8a852b825e
SHA129319cd5b6b0fbde3570d0b5fd2ec231cefbafd5
SHA256975db7ad9c29a75b59cc8c7db53ceffc7f6f854d567cee6d329a77060ef4d9d2
SHA5120b71f6eb065f0cda2fe0190bb08b753f6d5f631dd72d3a38518ff1a4e7890f8e8a43060fae9ceaa002d8e2eedeadc694e019e48eb7aa8f05bbff401b45ab15f6