Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe
Resource
win10v2004-20221111-en
General
-
Target
b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe
-
Size
732KB
-
MD5
a8e0d4771c1f71709ddb63d9a75dc895
-
SHA1
347b21e94912e99fb312153948d1f2758454e136
-
SHA256
b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4
-
SHA512
00eb0353b5568995dd359df63c166025f788a70d4616312c609bbad410faaca490fc84ea4379c3a3f2eaf50cabd97987e87d266f6a9c63786113ed44ed0dabf3
-
SSDEEP
12288:YOpgKjXa7yw83/HhJ0I1Rn7r0EQvqFg9iBUVC3noXA:YOpgKjqL83/IgYEQiFkMmEoX
Malware Config
Signatures
-
CryptoLocker
Ransomware family with multiple variants.
-
Executes dropped EXE 2 IoCs
pid Process 936 Wawbmdknpbal.exe 1704 Wawbmdknpbal.exe -
Deletes itself 1 IoCs
pid Process 936 Wawbmdknpbal.exe -
Loads dropped DLL 2 IoCs
pid Process 1340 b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe 1340 b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\Wawbmdknpbal.exe" Wawbmdknpbal.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce Wawbmdknpbal.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\Wawbmdknpbal.exe" Wawbmdknpbal.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run Wawbmdknpbal.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1340 wrote to memory of 936 1340 b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe 28 PID 1340 wrote to memory of 936 1340 b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe 28 PID 1340 wrote to memory of 936 1340 b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe 28 PID 1340 wrote to memory of 936 1340 b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe 28 PID 936 wrote to memory of 1704 936 Wawbmdknpbal.exe 29 PID 936 wrote to memory of 1704 936 Wawbmdknpbal.exe 29 PID 936 wrote to memory of 1704 936 Wawbmdknpbal.exe 29 PID 936 wrote to memory of 1704 936 Wawbmdknpbal.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe"C:\Users\Admin\AppData\Local\Temp\b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe"C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe" "/rC:\Users\Admin\AppData\Local\Temp\b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe"C:\Users\Admin\AppData\Roaming\Wawbmdknpbal.exe" /w0000011C3⤵
- Executes dropped EXE
PID:1704
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
732KB
MD5a8e0d4771c1f71709ddb63d9a75dc895
SHA1347b21e94912e99fb312153948d1f2758454e136
SHA256b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4
SHA51200eb0353b5568995dd359df63c166025f788a70d4616312c609bbad410faaca490fc84ea4379c3a3f2eaf50cabd97987e87d266f6a9c63786113ed44ed0dabf3
-
Filesize
732KB
MD5a8e0d4771c1f71709ddb63d9a75dc895
SHA1347b21e94912e99fb312153948d1f2758454e136
SHA256b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4
SHA51200eb0353b5568995dd359df63c166025f788a70d4616312c609bbad410faaca490fc84ea4379c3a3f2eaf50cabd97987e87d266f6a9c63786113ed44ed0dabf3
-
Filesize
732KB
MD5a8e0d4771c1f71709ddb63d9a75dc895
SHA1347b21e94912e99fb312153948d1f2758454e136
SHA256b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4
SHA51200eb0353b5568995dd359df63c166025f788a70d4616312c609bbad410faaca490fc84ea4379c3a3f2eaf50cabd97987e87d266f6a9c63786113ed44ed0dabf3
-
Filesize
732KB
MD5a8e0d4771c1f71709ddb63d9a75dc895
SHA1347b21e94912e99fb312153948d1f2758454e136
SHA256b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4
SHA51200eb0353b5568995dd359df63c166025f788a70d4616312c609bbad410faaca490fc84ea4379c3a3f2eaf50cabd97987e87d266f6a9c63786113ed44ed0dabf3
-
Filesize
732KB
MD5a8e0d4771c1f71709ddb63d9a75dc895
SHA1347b21e94912e99fb312153948d1f2758454e136
SHA256b3530b7519660996d28eb31a8d5b585ec60601843c77dd9f2b712812c99843e4
SHA51200eb0353b5568995dd359df63c166025f788a70d4616312c609bbad410faaca490fc84ea4379c3a3f2eaf50cabd97987e87d266f6a9c63786113ed44ed0dabf3