Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe
Resource
win10v2004-20220901-en
General
-
Target
e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe
-
Size
41KB
-
MD5
095be71db8bf27fc4db5e414ccc2ee31
-
SHA1
7d101711ed050ee4fdbf8bb1f9504938e6a02aea
-
SHA256
e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac
-
SHA512
4c67200af2c8be6de962ae27680910a52bcdd356a9a6fcf9f6f646b6f848ff2e3f872de34150bb9f11fe98351d19768224eb6f2d51682098dc320a695c103066
-
SSDEEP
768:QIBar1ZIZYnfI9opm6AIHIjaI7g9mVmUnioNE/W5dRV8:pW1ZIZqI9opm6AIHIjzmUzNzd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 760 sxhost.exe -
Deletes itself 1 IoCs
pid Process 1684 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1388 wrote to memory of 760 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe 27 PID 1388 wrote to memory of 760 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe 27 PID 1388 wrote to memory of 760 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe 27 PID 1388 wrote to memory of 760 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe 27 PID 1388 wrote to memory of 1684 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe 28 PID 1388 wrote to memory of 1684 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe 28 PID 1388 wrote to memory of 1684 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe 28 PID 1388 wrote to memory of 1684 1388 e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe 28 PID 760 wrote to memory of 1768 760 sxhost.exe 32 PID 760 wrote to memory of 1768 760 sxhost.exe 32 PID 760 wrote to memory of 1768 760 sxhost.exe 32 PID 760 wrote to memory of 1768 760 sxhost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe"C:\Users\Admin\AppData\Local\Temp\e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\sxhost.exe"C:\Users\Admin\sxhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\sxhost.exe >> NUL3⤵PID:1768
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E81CF1~1.EXE >> NUL2⤵
- Deletes itself
PID:1684
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5095be71db8bf27fc4db5e414ccc2ee31
SHA17d101711ed050ee4fdbf8bb1f9504938e6a02aea
SHA256e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac
SHA5124c67200af2c8be6de962ae27680910a52bcdd356a9a6fcf9f6f646b6f848ff2e3f872de34150bb9f11fe98351d19768224eb6f2d51682098dc320a695c103066
-
Filesize
41KB
MD5095be71db8bf27fc4db5e414ccc2ee31
SHA17d101711ed050ee4fdbf8bb1f9504938e6a02aea
SHA256e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac
SHA5124c67200af2c8be6de962ae27680910a52bcdd356a9a6fcf9f6f646b6f848ff2e3f872de34150bb9f11fe98351d19768224eb6f2d51682098dc320a695c103066
-
Filesize
41KB
MD5095be71db8bf27fc4db5e414ccc2ee31
SHA17d101711ed050ee4fdbf8bb1f9504938e6a02aea
SHA256e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac
SHA5124c67200af2c8be6de962ae27680910a52bcdd356a9a6fcf9f6f646b6f848ff2e3f872de34150bb9f11fe98351d19768224eb6f2d51682098dc320a695c103066
-
Filesize
41KB
MD5095be71db8bf27fc4db5e414ccc2ee31
SHA17d101711ed050ee4fdbf8bb1f9504938e6a02aea
SHA256e81cf1b3b935df71dfb7d4b85ad00f9437d7201da6224201d3e42943bc5568ac
SHA5124c67200af2c8be6de962ae27680910a52bcdd356a9a6fcf9f6f646b6f848ff2e3f872de34150bb9f11fe98351d19768224eb6f2d51682098dc320a695c103066