Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 10:40

General

  • Target

    3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe

  • Size

    10.8MB

  • MD5

    af17d0eb86bd4bdf9c16df91a18b9a5e

  • SHA1

    631b51a335e9792f4f5785acbc6ba71829fcb89f

  • SHA256

    3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80

  • SHA512

    f5fbd8479ed195f6405ecc5171fb1bb3d2c272c1d7dbd4a82b50c8ee0913b378f67c75676e2ffb5d182b567c4cd183256fcdcd7665bae93f17063b6c8325d7c7

  • SSDEEP

    196608:ozTIkxliL1wdKU1UMtN0l3ot+gWh5BtKG2kQr3sJjG3xr7S0IspbtaRrV:o3IKiL1wdKU1FiYUh5aG2xr8JUru0IOo

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe
    "C:\Users\Admin\AppData\Local\Temp\3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Users\Admin\AppData\Local\Temp\3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe
      "C:\Users\Admin\AppData\Local\Temp\3a11ccc8db0d99c7c5672ce57b5912310f79b5f00b1deeb6c097996e18967a80.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1624

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1624-54-0x0000000000400000-0x00000000005A3000-memory.dmp

    Filesize

    1.6MB

  • memory/1624-56-0x0000000000400000-0x00000000005A3000-memory.dmp

    Filesize

    1.6MB

  • memory/1624-57-0x0000000000400000-0x00000000005A3000-memory.dmp

    Filesize

    1.6MB

  • memory/1624-58-0x0000000076961000-0x0000000076963000-memory.dmp

    Filesize

    8KB

  • memory/1624-59-0x0000000000400000-0x00000000005A3000-memory.dmp

    Filesize

    1.6MB