Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 09:51

General

  • Target

    76778cc933a95c4d337da290c8bf31b16e0b86cc9334f7fe20da0cd9824ae555.exe

  • Size

    136KB

  • MD5

    f50d99bccf748739c64f2cb81b02bdcb

  • SHA1

    f6fc9f7ddaeaee7546812fbaae908ac506bdfc75

  • SHA256

    76778cc933a95c4d337da290c8bf31b16e0b86cc9334f7fe20da0cd9824ae555

  • SHA512

    8392bb85969a0698ef2d6db3b5a91ff0241e8505fb655767a93bf05067ed155da7cefa2bdb95da320863a7cffe18fd674e032946afcc181aba7574b1552ee3c1

  • SSDEEP

    1536:4FooN1+F6eKZO2DXseqFC9jtoIKk5M8nKJS4p5oaLBhHSN/I+VxeO:hoyFpEO2DXseqSo05xx4Qbi+7eO

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 58 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76778cc933a95c4d337da290c8bf31b16e0b86cc9334f7fe20da0cd9824ae555.exe
    "C:\Users\Admin\AppData\Local\Temp\76778cc933a95c4d337da290c8bf31b16e0b86cc9334f7fe20da0cd9824ae555.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Users\Admin\diuicih.exe
      "C:\Users\Admin\diuicih.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\diuicih.exe

    Filesize

    136KB

    MD5

    7d7949925dbf09479b7c9fd329fb1c56

    SHA1

    89639aed0d353ba888f25ff53cd825cd363118ed

    SHA256

    8fdec10d49949bb097f3dc211a12b8f40f8df92a10cc3d45ec60b399477509d8

    SHA512

    978459414c2ae788e83781cbc7579349cddc184049ccba6446b53815e317a7400c763d43e9e50a5f1945985b246ef09549f9a75f34b26a4002980415992f3e52

  • C:\Users\Admin\diuicih.exe

    Filesize

    136KB

    MD5

    7d7949925dbf09479b7c9fd329fb1c56

    SHA1

    89639aed0d353ba888f25ff53cd825cd363118ed

    SHA256

    8fdec10d49949bb097f3dc211a12b8f40f8df92a10cc3d45ec60b399477509d8

    SHA512

    978459414c2ae788e83781cbc7579349cddc184049ccba6446b53815e317a7400c763d43e9e50a5f1945985b246ef09549f9a75f34b26a4002980415992f3e52

  • \Users\Admin\diuicih.exe

    Filesize

    136KB

    MD5

    7d7949925dbf09479b7c9fd329fb1c56

    SHA1

    89639aed0d353ba888f25ff53cd825cd363118ed

    SHA256

    8fdec10d49949bb097f3dc211a12b8f40f8df92a10cc3d45ec60b399477509d8

    SHA512

    978459414c2ae788e83781cbc7579349cddc184049ccba6446b53815e317a7400c763d43e9e50a5f1945985b246ef09549f9a75f34b26a4002980415992f3e52

  • \Users\Admin\diuicih.exe

    Filesize

    136KB

    MD5

    7d7949925dbf09479b7c9fd329fb1c56

    SHA1

    89639aed0d353ba888f25ff53cd825cd363118ed

    SHA256

    8fdec10d49949bb097f3dc211a12b8f40f8df92a10cc3d45ec60b399477509d8

    SHA512

    978459414c2ae788e83781cbc7579349cddc184049ccba6446b53815e317a7400c763d43e9e50a5f1945985b246ef09549f9a75f34b26a4002980415992f3e52

  • memory/1468-56-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

    Filesize

    8KB