Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    183s
  • max time network
    111s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 00:01

General

  • Target

    90195488bf020d45a90b61341611038f40158997226a9202e53cb451238a22c9.exe

  • Size

    193KB

  • MD5

    aa2facd23c967594a5cef3e9aed15304

  • SHA1

    0d53426bace559039557611e149fb8e69b7bab71

  • SHA256

    90195488bf020d45a90b61341611038f40158997226a9202e53cb451238a22c9

  • SHA512

    b163aa231cd6d34c480e1ccd9b8f7b4c7274535f20697c429b3f1a68c6a2bbb819482ebfd8eb32fd5ab0adec097708a27bd13008c36815e8a57924cccef0d705

  • SSDEEP

    6144:Qolkmb5rrFOt4ayMvz58xJ4Fcj8oQVD+/:I1ttuaFccV

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90195488bf020d45a90b61341611038f40158997226a9202e53cb451238a22c9.exe
    "C:\Users\Admin\AppData\Local\Temp\90195488bf020d45a90b61341611038f40158997226a9202e53cb451238a22c9.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Users\Admin\qeobaq.exe
      "C:\Users\Admin\qeobaq.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1484

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\qeobaq.exe

    Filesize

    193KB

    MD5

    f58b5b3bfe877768ca8dd92a93d6d504

    SHA1

    1e54eaa42bee0f77c6304f9d64840340792b499e

    SHA256

    b8d5b07b6685ee83d61b379ddbe816c1c443db9e22441da0a37d50cca0784404

    SHA512

    828be0a90c190615eeff9219db458fbb0128438e15c6e1da9a625b3d454e43cc4c972716d6d163f3b0dafee6db65a14835a0cdf590a86327001e3e531e442179

  • C:\Users\Admin\qeobaq.exe

    Filesize

    193KB

    MD5

    f58b5b3bfe877768ca8dd92a93d6d504

    SHA1

    1e54eaa42bee0f77c6304f9d64840340792b499e

    SHA256

    b8d5b07b6685ee83d61b379ddbe816c1c443db9e22441da0a37d50cca0784404

    SHA512

    828be0a90c190615eeff9219db458fbb0128438e15c6e1da9a625b3d454e43cc4c972716d6d163f3b0dafee6db65a14835a0cdf590a86327001e3e531e442179

  • \Users\Admin\qeobaq.exe

    Filesize

    193KB

    MD5

    f58b5b3bfe877768ca8dd92a93d6d504

    SHA1

    1e54eaa42bee0f77c6304f9d64840340792b499e

    SHA256

    b8d5b07b6685ee83d61b379ddbe816c1c443db9e22441da0a37d50cca0784404

    SHA512

    828be0a90c190615eeff9219db458fbb0128438e15c6e1da9a625b3d454e43cc4c972716d6d163f3b0dafee6db65a14835a0cdf590a86327001e3e531e442179

  • \Users\Admin\qeobaq.exe

    Filesize

    193KB

    MD5

    f58b5b3bfe877768ca8dd92a93d6d504

    SHA1

    1e54eaa42bee0f77c6304f9d64840340792b499e

    SHA256

    b8d5b07b6685ee83d61b379ddbe816c1c443db9e22441da0a37d50cca0784404

    SHA512

    828be0a90c190615eeff9219db458fbb0128438e15c6e1da9a625b3d454e43cc4c972716d6d163f3b0dafee6db65a14835a0cdf590a86327001e3e531e442179

  • memory/1516-56-0x0000000075C81000-0x0000000075C83000-memory.dmp

    Filesize

    8KB