Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    44s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 23:27

General

  • Target

    99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe

  • Size

    177KB

  • MD5

    1e6054e7c0223d0c1508cbe1f7385be5

  • SHA1

    81dd2d3672a77e30814cc0f2dc33b1060e36fea5

  • SHA256

    99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94

  • SHA512

    66b69db35b8d8a7fd500d46fcea38e714e5a33bb4947a091ec4b3d266707c578f7a468b1764e0a5b86a2045b86cd7e10572c4415c40ed070fa272da63c8649de

  • SSDEEP

    3072:RWM9GVvfUoNkaCGaHz+BUVC6GrVM5OXAfVXbmeWcnb:cpVvfUyka4qBiLSVMIXANXbmeR

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 29 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe
    "C:\Users\Admin\AppData\Local\Temp\99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\mws77814.dll
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:1704

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\mws77814.dll

    Filesize

    172KB

    MD5

    3d866f8eb363d9f57f473e663d5cfdda

    SHA1

    b336650ff8899dfd76e901bf6d8cf02c9283ba6e

    SHA256

    2d8b5fb77b8f24879a50f32fd99490543ea0a684fb1d8195f7a318b9977a40b8

    SHA512

    6ad6bac7a5e44d984f3dbf76040dad3fd7a29f73cb97ff6606d36e2e5504a616fa785a36e3ffb5e257d53fd09fe5f856e3a6ec6c59ddaf8349deaa34fcd41da9

  • \Windows\SysWOW64\mws77814.dll

    Filesize

    172KB

    MD5

    3d866f8eb363d9f57f473e663d5cfdda

    SHA1

    b336650ff8899dfd76e901bf6d8cf02c9283ba6e

    SHA256

    2d8b5fb77b8f24879a50f32fd99490543ea0a684fb1d8195f7a318b9977a40b8

    SHA512

    6ad6bac7a5e44d984f3dbf76040dad3fd7a29f73cb97ff6606d36e2e5504a616fa785a36e3ffb5e257d53fd09fe5f856e3a6ec6c59ddaf8349deaa34fcd41da9

  • memory/1464-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

    Filesize

    8KB