Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe
Resource
win10v2004-20221111-en
General
-
Target
3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe
-
Size
10.8MB
-
MD5
af17d0eb86bd4bdf9c16df91a18b9a5e
-
SHA1
631b51a335e9792f4f5785acbc6ba71829fcb89f
-
SHA256
3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80
-
SHA512
f5fbd8479ed195f6405ecc5171fb1bb3d2c272c1d7dbd4a82b50c8ee0913b378f67c75676e2ffb5d182b567c4cd183256fcdcd7665bae93f17063b6c8325d7c7
-
SSDEEP
196608:ozTIkxliL1wdKU1UMtN0l3ot+gWh5BtKG2kQr3sJjG3xr7S0IspbtaRrV:o3IKiL1wdKU1FiYUh5aG2xr8JUru0IOo
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1116 set thread context of 1624 1116 3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1624 3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1116 wrote to memory of 1624 1116 3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe 27 PID 1116 wrote to memory of 1624 1116 3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe 27 PID 1116 wrote to memory of 1624 1116 3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe 27 PID 1116 wrote to memory of 1624 1116 3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe 27 PID 1116 wrote to memory of 1624 1116 3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe 27 PID 1116 wrote to memory of 1624 1116 3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe"C:\Users\Admin\AppData\Local\Temp\3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe"C:\Users\Admin\AppData\Local\Temp\3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1624
-