Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe
Resource
win10v2004-20220901-en
General
-
Target
3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe
-
Size
343KB
-
MD5
37f698206c504b3d910aa80159176390
-
SHA1
affe89ead19dcb98eb6b3add29b0411b94b68ee9
-
SHA256
3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5
-
SHA512
6a75ddd391616e5c4074557ac2eff5a519d295b3c115004481392cf8d70f9addf07805d87f082866036bea3cc1b3cd471e769396b55e8dc908ed11510ec70801
-
SSDEEP
6144:WJ+SJhKb7cpwPBAggA6dqEGXDFqJH1dabccbi+bNjS8ki/gtL+fdzUTwMQsWt:zvcpwPrgLdq/0j2bNTtglW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 664 QQ.exe -
Loads dropped DLL 1 IoCs
pid Process 1644 3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1020 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1644 wrote to memory of 1020 1644 3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe 28 PID 1644 wrote to memory of 1020 1644 3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe 28 PID 1644 wrote to memory of 1020 1644 3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe 28 PID 1644 wrote to memory of 1020 1644 3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe 28 PID 1644 wrote to memory of 664 1644 3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe 29 PID 1644 wrote to memory of 664 1644 3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe 29 PID 1644 wrote to memory of 664 1644 3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe 29 PID 1644 wrote to memory of 664 1644 3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe"C:\Users\Admin\AppData\Local\Temp\3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\s.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1020
-
-
C:\Users\Admin\AppData\Roaming\QQ.exe"C:\Users\Admin\AppData\Roaming\QQ.exe"2⤵
- Executes dropped EXE
PID:664
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
329KB
MD58ca122348a7e3001df407e195dfeb081
SHA1bb4153350484dbb7dc1fc882e6d4847337d0b544
SHA2566c9016245e6f74606b371c662b32a93ab436958314373c9564cab2ed41779983
SHA51280bad5990264255a2a1a52ba57f7a478121ddac49c0440200fecdfbf4d0ccbf776f714795a979560a8a2a01001dac1205f2324ac30bf0f3438f3d1150fd4a799
-
Filesize
21B
MD54b0643cd867cea48ebff640971b05e7b
SHA14e812ec2c48c6946989d3668a16446c2111be026
SHA256f441ce43dfda2688b421faa136383e173caf18aaed30c870229bbff3c4b6b36a
SHA512a1a0ce3ffc7082f6d9c7ff68180be1ef3eb2969996b749549d92727ac6c10b047eb8753c050dc3986d349f16519b3180c7f16243f34c034763ac4db1f9a14d58
-
Filesize
329KB
MD58ca122348a7e3001df407e195dfeb081
SHA1bb4153350484dbb7dc1fc882e6d4847337d0b544
SHA2566c9016245e6f74606b371c662b32a93ab436958314373c9564cab2ed41779983
SHA51280bad5990264255a2a1a52ba57f7a478121ddac49c0440200fecdfbf4d0ccbf776f714795a979560a8a2a01001dac1205f2324ac30bf0f3438f3d1150fd4a799