Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    40s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 20:07

General

  • Target

    abf5548bcd9f4ce7f083e879e6d145a55f368f7c78e8d76380d0f37a2b52ff3a.exe

  • Size

    176KB

  • MD5

    e00c68a4474dd611fd01383066d7384f

  • SHA1

    1efaccd47e950855520699b84ef86d0eaa561333

  • SHA256

    abf5548bcd9f4ce7f083e879e6d145a55f368f7c78e8d76380d0f37a2b52ff3a

  • SHA512

    824dadd71c02f227b4d7ee9ed78b2de5e1860ec782a7e59e8b86b3971eb3a15104a4e145de5fecd4df48c526dd50a6c3de7570055c34b9f268b6e3345eb01fe2

  • SSDEEP

    3072:wf72p1zO+daiyK8+Yb6RJ6Ea6uKnvmb7/D26CEmIOJ1va0YOlR9vqgeleYCDk0sg:E2p1d8iyK2b6RJXWKnvmb7/D26CEmIOJ

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 49 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abf5548bcd9f4ce7f083e879e6d145a55f368f7c78e8d76380d0f37a2b52ff3a.exe
    "C:\Users\Admin\AppData\Local\Temp\abf5548bcd9f4ce7f083e879e6d145a55f368f7c78e8d76380d0f37a2b52ff3a.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Users\Admin\reunau.exe
      "C:\Users\Admin\reunau.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:856

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\reunau.exe

    Filesize

    176KB

    MD5

    023ff4337c0a7a23600073fc8261b3e8

    SHA1

    3c042637331ec8f1457f65a752648a0c9cd5ea9a

    SHA256

    45536c2394f8f598e582c56476cb8428afff71135b233bbc834bf4b9a77307cd

    SHA512

    b2f4640270a67128c9793f1c5a0fe2eedfdd8e21fc37272176451c93277fed1fcc447dc8b71ada81f3fae34e6c142b4a6843e11c0b882cdade50ed5b4a1431fc

  • C:\Users\Admin\reunau.exe

    Filesize

    176KB

    MD5

    023ff4337c0a7a23600073fc8261b3e8

    SHA1

    3c042637331ec8f1457f65a752648a0c9cd5ea9a

    SHA256

    45536c2394f8f598e582c56476cb8428afff71135b233bbc834bf4b9a77307cd

    SHA512

    b2f4640270a67128c9793f1c5a0fe2eedfdd8e21fc37272176451c93277fed1fcc447dc8b71ada81f3fae34e6c142b4a6843e11c0b882cdade50ed5b4a1431fc

  • \Users\Admin\reunau.exe

    Filesize

    176KB

    MD5

    023ff4337c0a7a23600073fc8261b3e8

    SHA1

    3c042637331ec8f1457f65a752648a0c9cd5ea9a

    SHA256

    45536c2394f8f598e582c56476cb8428afff71135b233bbc834bf4b9a77307cd

    SHA512

    b2f4640270a67128c9793f1c5a0fe2eedfdd8e21fc37272176451c93277fed1fcc447dc8b71ada81f3fae34e6c142b4a6843e11c0b882cdade50ed5b4a1431fc

  • \Users\Admin\reunau.exe

    Filesize

    176KB

    MD5

    023ff4337c0a7a23600073fc8261b3e8

    SHA1

    3c042637331ec8f1457f65a752648a0c9cd5ea9a

    SHA256

    45536c2394f8f598e582c56476cb8428afff71135b233bbc834bf4b9a77307cd

    SHA512

    b2f4640270a67128c9793f1c5a0fe2eedfdd8e21fc37272176451c93277fed1fcc447dc8b71ada81f3fae34e6c142b4a6843e11c0b882cdade50ed5b4a1431fc

  • memory/1756-56-0x0000000075F51000-0x0000000075F53000-memory.dmp

    Filesize

    8KB