Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 09:34

General

  • Target

    abda8844ba9e0efcbbd5dc7b333c3d70f89e4ef8d700e0b93eceb7e87d69d02f.exe

  • Size

    164KB

  • MD5

    38cd432bfbe64b080e95ed9e6faec5c8

  • SHA1

    44986ba3b0720697328b6bedf20fcc8470246ca3

  • SHA256

    abda8844ba9e0efcbbd5dc7b333c3d70f89e4ef8d700e0b93eceb7e87d69d02f

  • SHA512

    4cc04f17f955559e3b1fd6c4589207cc4b2ffb1bab7fc68e79385451668fc62e12fd6ae97ec63df407c377e74f524c01ea7d5591c9ebd33b71fd4db9c34d4b54

  • SSDEEP

    1536:5XpwdMTapIT86E4KABCIvhhNOUeO6X+NPouHj6KoaDEl10SN+F8OR6t+B:9pwdTIT86EbY6ja3S+

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 58 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abda8844ba9e0efcbbd5dc7b333c3d70f89e4ef8d700e0b93eceb7e87d69d02f.exe
    "C:\Users\Admin\AppData\Local\Temp\abda8844ba9e0efcbbd5dc7b333c3d70f89e4ef8d700e0b93eceb7e87d69d02f.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Users\Admin\bouvee.exe
      "C:\Users\Admin\bouvee.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1364

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\bouvee.exe

    Filesize

    164KB

    MD5

    ed56d62212f2d3ec50a5a640136b2414

    SHA1

    f4170c13d914e3102023cccc87b73bcbee1d90ef

    SHA256

    8b01f2caf80f92b8a36028b512c567227abcd9eb15d56af5deab9740eeba30d6

    SHA512

    4b0a6c1594a3c77030e076c591a213f8b886004321d4796de1c4efe5e6af62ca320cdc48927fc70997f84d1d7c2c825e26cbfb2251228ceb672d6cde8c8a4139

  • C:\Users\Admin\bouvee.exe

    Filesize

    164KB

    MD5

    ed56d62212f2d3ec50a5a640136b2414

    SHA1

    f4170c13d914e3102023cccc87b73bcbee1d90ef

    SHA256

    8b01f2caf80f92b8a36028b512c567227abcd9eb15d56af5deab9740eeba30d6

    SHA512

    4b0a6c1594a3c77030e076c591a213f8b886004321d4796de1c4efe5e6af62ca320cdc48927fc70997f84d1d7c2c825e26cbfb2251228ceb672d6cde8c8a4139

  • \Users\Admin\bouvee.exe

    Filesize

    164KB

    MD5

    ed56d62212f2d3ec50a5a640136b2414

    SHA1

    f4170c13d914e3102023cccc87b73bcbee1d90ef

    SHA256

    8b01f2caf80f92b8a36028b512c567227abcd9eb15d56af5deab9740eeba30d6

    SHA512

    4b0a6c1594a3c77030e076c591a213f8b886004321d4796de1c4efe5e6af62ca320cdc48927fc70997f84d1d7c2c825e26cbfb2251228ceb672d6cde8c8a4139

  • \Users\Admin\bouvee.exe

    Filesize

    164KB

    MD5

    ed56d62212f2d3ec50a5a640136b2414

    SHA1

    f4170c13d914e3102023cccc87b73bcbee1d90ef

    SHA256

    8b01f2caf80f92b8a36028b512c567227abcd9eb15d56af5deab9740eeba30d6

    SHA512

    4b0a6c1594a3c77030e076c591a213f8b886004321d4796de1c4efe5e6af62ca320cdc48927fc70997f84d1d7c2c825e26cbfb2251228ceb672d6cde8c8a4139

  • memory/1912-56-0x00000000763F1000-0x00000000763F3000-memory.dmp

    Filesize

    8KB