Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
04/12/2022, 00:16
General
-
Target
e2b02da2a58b918199626bcc52f3a842440bbd23715f179e7a944922feb0b808.exe
-
Size
828KB
-
MD5
26608a57f2b678cee9ef5eab4bc737cc
-
SHA1
6c2112b6fdff02f6389332af135b6d9df525af0b
-
SHA256
e2b02da2a58b918199626bcc52f3a842440bbd23715f179e7a944922feb0b808
-
SHA512
fbaa55ae5817c8fbc1c0e97eefeb5219e37b46bd124a8487f3823f5cb4538641da1b5e82fcaf82c8e120d899689847b34791a85827e0276c3fe811ae1beee142
-
SSDEEP
12288:6NzLqXCUQ3EZ52fJ54DD/8TY4vyvFTmuH4i1kYYUoUs/ahG7Vki+BGN8t4q56:CHnN3ED2fcDDl1hfLnYCs/a07Vki+B
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2b02da2a58b918199626bcc52f3a842440bbd23715f179e7a944922feb0b808.exe"C:\Users\Admin\AppData\Local\Temp\e2b02da2a58b918199626bcc52f3a842440bbd23715f179e7a944922feb0b808.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
828KB
-
Filesize
828KB