Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
8cdec219296c2da638517bd189e1dfcd4a0cbb6abbfa10df84498f1d963cd1a5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8cdec219296c2da638517bd189e1dfcd4a0cbb6abbfa10df84498f1d963cd1a5.exe
Resource
win10v2004-20220901-en
General
-
Target
8cdec219296c2da638517bd189e1dfcd4a0cbb6abbfa10df84498f1d963cd1a5.exe
-
Size
68KB
-
MD5
276ed8ad0264590bef53e4ae98f9b480
-
SHA1
f1b2a1a34c5f57837e8a04acaca3e0664e506017
-
SHA256
8cdec219296c2da638517bd189e1dfcd4a0cbb6abbfa10df84498f1d963cd1a5
-
SHA512
f1c7e350428c9b0cc4f68939e4bc0ec0fee5957ebe383d513e2b84a5cdae512d011ed4704a00fb6e8a9673dc41a52651e6f0003bcd2de144cc402a7569e27da0
-
SSDEEP
768:O4G+pB9nd/fSzThSl+afH7Tijl0+PsfbY1A4cGcStjhdw/f2fLIU0j4Lv4w8zV81:OwpczcfKa+0k1lcew2fLIU88v4wAYdln
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QQGame = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8cdec219296c2da638517bd189e1dfcd4a0cbb6abbfa10df84498f1d963cd1a5.exe" 8cdec219296c2da638517bd189e1dfcd4a0cbb6abbfa10df84498f1d963cd1a5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 8cdec219296c2da638517bd189e1dfcd4a0cbb6abbfa10df84498f1d963cd1a5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kxetray.exe = "C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Ç¿Á¦Ð¶ÔصçÄÔÉϵÄÈí¼þ.lnk" 8cdec219296c2da638517bd189e1dfcd4a0cbb6abbfa10df84498f1d963cd1a5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.