Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 11:39

General

  • Target

    f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe

  • Size

    249KB

  • MD5

    2b82893a9dcb25fd752ed810c2e95c88

  • SHA1

    65220d72910a7059401a312c503d07c239b23b23

  • SHA256

    f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de

  • SHA512

    fb1ccae8fe534f3858aea6fb93f94e1c5acef333016e9199300688a0736f5dfb9313f1d1ff6a871eab3cc416eb0a2c6bcfd31a74c6eb70cbad5b42491872af0b

  • SSDEEP

    6144:I5OuRiaa832T8oBCP4l0X6J6oHfY6aFTH27CHXVJGS8msd5YxG6jL:NuRvn3M8vX6f/taFTW7sXDw5oL

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe
    "C:\Users\Admin\AppData\Local\Temp\f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\AppData\Roaming\zmd67tm4.exe
      "C:\Users\Admin\AppData\Roaming\zmd67tm4.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1576

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\q4y4fcwwylnxnioy.dat

    Filesize

    8B

    MD5

    5bcbe1ecc2edff92295f615f3eb43e6c

    SHA1

    3c647f8990e643571d6a7fced46552b12d43550c

    SHA256

    8452d2e8d0f1501c70484431907f86c5ad33103676754bae69ec082b31d64260

    SHA512

    0c9f6d3ba60ead2feae76918dfd3c254314c1c4c8252d89bf24e38651dd0174b2f0a70af846c3a58d73953f5286e43f35cfe03c07ba886cc9014737ebd06d19f

  • C:\Users\Admin\AppData\Roaming\zmd67tm4.exe

    Filesize

    249KB

    MD5

    2b82893a9dcb25fd752ed810c2e95c88

    SHA1

    65220d72910a7059401a312c503d07c239b23b23

    SHA256

    f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de

    SHA512

    fb1ccae8fe534f3858aea6fb93f94e1c5acef333016e9199300688a0736f5dfb9313f1d1ff6a871eab3cc416eb0a2c6bcfd31a74c6eb70cbad5b42491872af0b

  • C:\Users\Admin\AppData\Roaming\zmd67tm4.exe

    Filesize

    249KB

    MD5

    2b82893a9dcb25fd752ed810c2e95c88

    SHA1

    65220d72910a7059401a312c503d07c239b23b23

    SHA256

    f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de

    SHA512

    fb1ccae8fe534f3858aea6fb93f94e1c5acef333016e9199300688a0736f5dfb9313f1d1ff6a871eab3cc416eb0a2c6bcfd31a74c6eb70cbad5b42491872af0b

  • \Users\Admin\AppData\Roaming\zmd67tm4.exe

    Filesize

    249KB

    MD5

    2b82893a9dcb25fd752ed810c2e95c88

    SHA1

    65220d72910a7059401a312c503d07c239b23b23

    SHA256

    f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de

    SHA512

    fb1ccae8fe534f3858aea6fb93f94e1c5acef333016e9199300688a0736f5dfb9313f1d1ff6a871eab3cc416eb0a2c6bcfd31a74c6eb70cbad5b42491872af0b

  • memory/1576-63-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1576-80-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

    Filesize

    8KB

  • memory/1672-55-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1672-59-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1672-61-0x0000000000230000-0x0000000000244000-memory.dmp

    Filesize

    80KB