Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    38s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 10:50

General

  • Target

    904fac1c3ff58a21e7c9a14909b2d0cac8e644f936075e655b560f1bf65e581b.exe

  • Size

    806KB

  • MD5

    435805b95efbe8075de6236d360a4bad

  • SHA1

    59fcfd582a975cfe21c52ea80435782b94037821

  • SHA256

    904fac1c3ff58a21e7c9a14909b2d0cac8e644f936075e655b560f1bf65e581b

  • SHA512

    b7ee6369ab1c0ee760590bef8d8c9db2368ee272408f0096efad0eb2c3bb7a6df09500e773ad3ee960f35c8bcedbbd3ae8e7d0af9b02512b729249feb8146d09

  • SSDEEP

    12288:dEncCP0UpnIIxU8H3Ek9aL4cLdWG51LSWxxLaLs/unEIZUlxOnY7a+1:4caAIxL3EkyrLdVLBdIKxQX0

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 53 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\904fac1c3ff58a21e7c9a14909b2d0cac8e644f936075e655b560f1bf65e581b.exe
    "C:\Users\Admin\AppData\Local\Temp\904fac1c3ff58a21e7c9a14909b2d0cac8e644f936075e655b560f1bf65e581b.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Drops file in Drivers directory
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:692
    • C:\Windows\SysWOW64\regedit.exe
      C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
      2⤵
      • Runs .reg file with regedit
      PID:1664
    • C:\Users\Admin\AppData\Local\Temp\904fac1c3ff58a21e7c9a14909b2d0cac8e644f936075e655b560f1bf65e581b.exe
      C:\Users\Admin\AppData\Local\Temp\904fac1c3ff58a21e7c9a14909b2d0cac8e644f936075e655b560f1bf65e581b.exe
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Windows\SysWOW64\regedit.exe
        C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
        3⤵
        • Runs .reg file with regedit
        PID:1764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\System\taobao.ico

    Filesize

    14KB

    MD5

    468fada123f5548ac87e57bae81f6782

    SHA1

    edb8f012c25906e6afd8bf335b495e16c440243d

    SHA256

    091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d

    SHA512

    635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa

  • C:\WINDOWS\system32\drivers\etc\hosts

    Filesize

    3KB

    MD5

    d325aecd8d8b564939f290e028dbbbf0

    SHA1

    749ebdab85b55dc161416e8deaa0a5af13fc76e3

    SHA256

    94489fb12b0c85e61d43ca38383cb62f5f4f1a64e88a3b7cc82c8b2ae411cdb2

    SHA512

    83c9a939588aa720650aed73a3bc0d7d6917cd5711c998baeb70065168d1e612ffbadc47619eb3f43a8812cc16be88de9ed6bfeb6703f66e48ab773471441b93

  • C:\Windows\SysWOW64\msscp.reg

    Filesize

    228B

    MD5

    2d06a424ad1c7611ea9caad93892ea26

    SHA1

    a901e15c2ecea498f1ca8ffc5d5c32bd3f0169d8

    SHA256

    8c19027357bcb3170b6844aec44cd4c143c7b795d5df52ff89426615010f715c

    SHA512

    3199dffce9d7625d9e01d7a06c912d3629e5f3d98d3935763df6b323807d46f24a40876d78d5ae7f7ac83c90e498e7c4810d88993904dbca1036e8c06833ccdf

  • C:\Windows\SysWOW64\msscp.reg

    Filesize

    228B

    MD5

    2d06a424ad1c7611ea9caad93892ea26

    SHA1

    a901e15c2ecea498f1ca8ffc5d5c32bd3f0169d8

    SHA256

    8c19027357bcb3170b6844aec44cd4c143c7b795d5df52ff89426615010f715c

    SHA512

    3199dffce9d7625d9e01d7a06c912d3629e5f3d98d3935763df6b323807d46f24a40876d78d5ae7f7ac83c90e498e7c4810d88993904dbca1036e8c06833ccdf

  • memory/692-54-0x0000000075601000-0x0000000075603000-memory.dmp

    Filesize

    8KB

  • memory/692-64-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB

  • memory/692-66-0x00000000020D0000-0x00000000021AD000-memory.dmp

    Filesize

    884KB

  • memory/692-68-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB

  • memory/1240-67-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB