Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
98s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 19:08
Static task
static1
Behavioral task
behavioral1
Sample
ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe
Resource
win10v2004-20220812-en
General
-
Target
ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe
-
Size
125KB
-
MD5
35f3e2fb0aa1b9e553a17c3b4f562f30
-
SHA1
578247e11932adb095d71e566e87746d869f4a3e
-
SHA256
ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23
-
SHA512
a902d709a06154c641244b63ecd1948930ec51a054a1602c7d8aa877ed49d7bdb1fbdd4c6c3056493c1b76c8a1e579094dcaa3701aa43b066035bf43e6a6357a
-
SSDEEP
1536:TIfsgr/bNdnZcOBQP6LAlUnhnLrirdb8+gXygMRV2zH3XgyCPq2KQPXgyFWaajVd:TIkgTbNdn7ULg8V2zXKv9GsIF/lg7U
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Internet Explorer.lnk ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windp32_tkf = "C:\\Program Files\\Winpows Publkf\\services.exe" regedit.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\1.txt ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe File opened for modification C:\Windows\SysWOW64\1.txt ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe File opened for modification C:\Windows\SysWOW64\internat.exe.txt ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe File opened for modification C:\Windows\SysWOW64\internat.exe ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe File opened for modification C:\Windows\SysWOW64\2.txt ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Winpows Publkf\services.exe.txt ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe File opened for modification C:\Program Files\Winpows Publkf\services.exe ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\WINDOWS\Winpows Publkf\services.exe.txt ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe File opened for modification C:\WINDOWS\Winpows Publkf\services.exe ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs .reg file with regedit 1 IoCs
pid Process 932 regedit.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 1504 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 1504 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 1504 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1504 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 27 PID 1776 wrote to memory of 1504 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 27 PID 1776 wrote to memory of 1504 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 27 PID 1776 wrote to memory of 1504 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 27 PID 1776 wrote to memory of 932 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 28 PID 1776 wrote to memory of 932 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 28 PID 1776 wrote to memory of 932 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 28 PID 1776 wrote to memory of 932 1776 ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe"C:\Users\Admin\AppData\Local\Temp\ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exeC:\Users\Admin\AppData\Local\Temp\ad8a61f8b0efd68574440334d8f0e1d4b761428ab6204c021d0376dd53d1ed23.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s C:\1.reg2⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:932
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171B
MD51a397deae9f18b382b4bae39ad5d3a34
SHA1eb68e372fd377540881aa8a46c7977f32405ee89
SHA256f96779cccce9a239c7df5cfc261e16d13dc5b019c409b5b679e31571ab6c3456
SHA5121ca00115cbef090471404a3a013c147ae5a82775f391ba2c3d62dc719f886f80760633d72dc1445d6bea1b9d1bfd13589f51aee16400b6346fbd79fcbae80be1