Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    233s
  • max time network
    333s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 14:53

General

  • Target

    58b184924957665f109bfbf08eee12879ea265beb29766aff797e6873cd3765b.exe

  • Size

    564KB

  • MD5

    f6334aba4e62849dd2f5ddebe8f57c6a

  • SHA1

    65085158f5e56c5010b2409b298cb08268f5c4aa

  • SHA256

    58b184924957665f109bfbf08eee12879ea265beb29766aff797e6873cd3765b

  • SHA512

    9eae3d6d33966d69ffaa83e00795877569813859d1bd583d4926bc601948484b4c6e6f4a76c1f3ff6bfc5e7a4519491554565a14f90e976b49c3d262fe811079

  • SSDEEP

    12288:vGQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAcV:v/IdQ8KglrNYltim/GRJx8AW

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58b184924957665f109bfbf08eee12879ea265beb29766aff797e6873cd3765b.exe
    "C:\Users\Admin\AppData\Local\Temp\58b184924957665f109bfbf08eee12879ea265beb29766aff797e6873cd3765b.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:476

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/476-54-0x0000000076931000-0x0000000076933000-memory.dmp

    Filesize

    8KB

  • memory/476-55-0x0000000074B11000-0x0000000074B13000-memory.dmp

    Filesize

    8KB