Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
245s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe
Resource
win10v2004-20220812-en
General
-
Target
8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe
-
Size
318KB
-
MD5
61f84d66a5a17e167e13a201330e59ee
-
SHA1
0b926845df78fdf81b4b8374d92a317862f41f3d
-
SHA256
8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7
-
SHA512
d13aa2cd5ae16fdf260f8c5df14696ef20369fada5f95c73e49b92d245207da3b649b534f8d5358bd08c7aa282df4bb7fae00994ddc51af64ad654e66b9d9183
-
SSDEEP
6144:P5BogeiM5RyVZts3UfNKUqeMiZRKNgMLcbxKkajReYYl1rdVvxf6sh/////P:RzimeUljqvsRKNgDKk6RPYl1TvxZh//X
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1928 EA_Keygen.exe 1780 zero.exe 888 win87.exe 1728 svchost.exe -
Loads dropped DLL 9 IoCs
pid Process 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 1780 zero.exe 1780 zero.exe 888 win87.exe 888 win87.exe 888 win87.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\runAPI69 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runAPI46.exe\"" zero.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run win87.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe" win87.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\zero.exe 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1780 set thread context of 888 1780 zero.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1776 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1776 AUDIODG.EXE Token: 33 1776 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1776 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1928 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 27 PID 1192 wrote to memory of 1928 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 27 PID 1192 wrote to memory of 1928 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 27 PID 1192 wrote to memory of 1928 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 27 PID 1192 wrote to memory of 1780 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 28 PID 1192 wrote to memory of 1780 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 28 PID 1192 wrote to memory of 1780 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 28 PID 1192 wrote to memory of 1780 1192 8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe 28 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 1780 wrote to memory of 888 1780 zero.exe 30 PID 888 wrote to memory of 1728 888 win87.exe 31 PID 888 wrote to memory of 1728 888 win87.exe 31 PID 888 wrote to memory of 1728 888 win87.exe 31 PID 888 wrote to memory of 1728 888 win87.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe"C:\Users\Admin\AppData\Local\Temp\8fc537037970b6891bd1e5537ee192ab128fb2a95d7087758af6033d9c3e8de7.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\EA_Keygen.exe"C:\Users\Admin\AppData\Local\Temp\EA_Keygen.exe"2⤵
- Executes dropped EXE
PID:1928
-
-
C:\Windows\SysWOW64\zero.exe"C:\Windows\system32\zero.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\win87.exeC:\Users\Admin\AppData\Local\Temp\win87.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"4⤵
- Executes dropped EXE
PID:1728
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD509bbea6a5f8ee12cbd3647ee74e2914a
SHA1e6286aca0a7dbbdb507a66d55c19074049a1c197
SHA25679afb5254ab3697e970cf6cdbd19e50993b593f4da60ff4fac5cc859ed4c2a69
SHA512ca705ab0d8a01c23d4033acdd5125540b5a483a222bb2d6234b7becbfeb5630b9115c4307abbc1f6bae53fc63173ff50e3a6db30b147de3ae87a1e6372c3cbb3
-
Filesize
4KB
MD55e5ecae8b08152c885904cde71c50dad
SHA1727f24d102ab29be690c783ddc149b3a39430fb6
SHA256b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541
SHA512dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea
-
Filesize
4KB
MD55e5ecae8b08152c885904cde71c50dad
SHA1727f24d102ab29be690c783ddc149b3a39430fb6
SHA256b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541
SHA512dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea
-
Filesize
4KB
MD55e5ecae8b08152c885904cde71c50dad
SHA1727f24d102ab29be690c783ddc149b3a39430fb6
SHA256b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541
SHA512dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea
-
Filesize
212KB
MD5c377c795f14dd65ca919fc1108f45197
SHA1fe1efbc85d7acbf9ce78baeaa7fed29c31ba6409
SHA256f4a14fce3586992a80501155dbc57d6857cd82d5c33248168c6f8f9a5a084dd9
SHA512276ab732c31f2f87c7b4cf3505878203a99d0b2e20534b9b5d78a281266f67c597b405a01b4be18600b77e37abb0059b345bb500b1afddea0ebb35c37b3b155c
-
Filesize
212KB
MD5c377c795f14dd65ca919fc1108f45197
SHA1fe1efbc85d7acbf9ce78baeaa7fed29c31ba6409
SHA256f4a14fce3586992a80501155dbc57d6857cd82d5c33248168c6f8f9a5a084dd9
SHA512276ab732c31f2f87c7b4cf3505878203a99d0b2e20534b9b5d78a281266f67c597b405a01b4be18600b77e37abb0059b345bb500b1afddea0ebb35c37b3b155c
-
Filesize
97KB
MD509bbea6a5f8ee12cbd3647ee74e2914a
SHA1e6286aca0a7dbbdb507a66d55c19074049a1c197
SHA25679afb5254ab3697e970cf6cdbd19e50993b593f4da60ff4fac5cc859ed4c2a69
SHA512ca705ab0d8a01c23d4033acdd5125540b5a483a222bb2d6234b7becbfeb5630b9115c4307abbc1f6bae53fc63173ff50e3a6db30b147de3ae87a1e6372c3cbb3
-
Filesize
97KB
MD509bbea6a5f8ee12cbd3647ee74e2914a
SHA1e6286aca0a7dbbdb507a66d55c19074049a1c197
SHA25679afb5254ab3697e970cf6cdbd19e50993b593f4da60ff4fac5cc859ed4c2a69
SHA512ca705ab0d8a01c23d4033acdd5125540b5a483a222bb2d6234b7becbfeb5630b9115c4307abbc1f6bae53fc63173ff50e3a6db30b147de3ae87a1e6372c3cbb3
-
Filesize
4KB
MD55e5ecae8b08152c885904cde71c50dad
SHA1727f24d102ab29be690c783ddc149b3a39430fb6
SHA256b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541
SHA512dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea
-
Filesize
4KB
MD55e5ecae8b08152c885904cde71c50dad
SHA1727f24d102ab29be690c783ddc149b3a39430fb6
SHA256b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541
SHA512dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea
-
Filesize
4KB
MD55e5ecae8b08152c885904cde71c50dad
SHA1727f24d102ab29be690c783ddc149b3a39430fb6
SHA256b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541
SHA512dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea
-
Filesize
4KB
MD55e5ecae8b08152c885904cde71c50dad
SHA1727f24d102ab29be690c783ddc149b3a39430fb6
SHA256b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541
SHA512dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea
-
Filesize
4KB
MD55e5ecae8b08152c885904cde71c50dad
SHA1727f24d102ab29be690c783ddc149b3a39430fb6
SHA256b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541
SHA512dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea
-
Filesize
212KB
MD5c377c795f14dd65ca919fc1108f45197
SHA1fe1efbc85d7acbf9ce78baeaa7fed29c31ba6409
SHA256f4a14fce3586992a80501155dbc57d6857cd82d5c33248168c6f8f9a5a084dd9
SHA512276ab732c31f2f87c7b4cf3505878203a99d0b2e20534b9b5d78a281266f67c597b405a01b4be18600b77e37abb0059b345bb500b1afddea0ebb35c37b3b155c
-
Filesize
212KB
MD5c377c795f14dd65ca919fc1108f45197
SHA1fe1efbc85d7acbf9ce78baeaa7fed29c31ba6409
SHA256f4a14fce3586992a80501155dbc57d6857cd82d5c33248168c6f8f9a5a084dd9
SHA512276ab732c31f2f87c7b4cf3505878203a99d0b2e20534b9b5d78a281266f67c597b405a01b4be18600b77e37abb0059b345bb500b1afddea0ebb35c37b3b155c