Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 18:14

General

  • Target

    f64fe3a9122d0eee681e58d5f65ace09a6e2dfe55268674bfcf374325bdba96b.exe

  • Size

    156KB

  • MD5

    c48d0c48b21db1d540c225a87f143361

  • SHA1

    91a704afc313cf41de7e3f43cbbdb61f55dbc28e

  • SHA256

    f64fe3a9122d0eee681e58d5f65ace09a6e2dfe55268674bfcf374325bdba96b

  • SHA512

    bebcfd61c614783db173b21f5fd2a15d57190603d5e5732856314a9d1f09df93b60aa01721c402e67f0389c8bb94fa6395df8e02b6ab9c288f7a7cde6d81cc76

  • SSDEEP

    3072:a5/5qj0C0H3RvXs45qlCG8v12aO1AwPgamPet2IZahE5j4oQ:Q5W0Lvulf8v12aO1AwSPetRdd

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f64fe3a9122d0eee681e58d5f65ace09a6e2dfe55268674bfcf374325bdba96b.exe
    "C:\Users\Admin\AppData\Local\Temp\f64fe3a9122d0eee681e58d5f65ace09a6e2dfe55268674bfcf374325bdba96b.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\deajiut.exe
      "C:\Users\Admin\deajiut.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\deajiut.exe

    Filesize

    156KB

    MD5

    410748467e6fcb378a67bcb52760d00a

    SHA1

    ac26e69a82d643a3cf5386dd805c37d451aab6c4

    SHA256

    358846147d2cf533a376f2aa44f0ac3dcb5072f0b35f717936f0b86e0340b8bf

    SHA512

    b85afb80c245a2d9828971e3da43b0e078cce40d287fcf2a92c8a1ea8f2989ea2b90321f5504d544fbc8f3ba03dd449e6c4b84a5e643d97ec017d65281997235

  • C:\Users\Admin\deajiut.exe

    Filesize

    156KB

    MD5

    410748467e6fcb378a67bcb52760d00a

    SHA1

    ac26e69a82d643a3cf5386dd805c37d451aab6c4

    SHA256

    358846147d2cf533a376f2aa44f0ac3dcb5072f0b35f717936f0b86e0340b8bf

    SHA512

    b85afb80c245a2d9828971e3da43b0e078cce40d287fcf2a92c8a1ea8f2989ea2b90321f5504d544fbc8f3ba03dd449e6c4b84a5e643d97ec017d65281997235

  • \Users\Admin\deajiut.exe

    Filesize

    156KB

    MD5

    410748467e6fcb378a67bcb52760d00a

    SHA1

    ac26e69a82d643a3cf5386dd805c37d451aab6c4

    SHA256

    358846147d2cf533a376f2aa44f0ac3dcb5072f0b35f717936f0b86e0340b8bf

    SHA512

    b85afb80c245a2d9828971e3da43b0e078cce40d287fcf2a92c8a1ea8f2989ea2b90321f5504d544fbc8f3ba03dd449e6c4b84a5e643d97ec017d65281997235

  • \Users\Admin\deajiut.exe

    Filesize

    156KB

    MD5

    410748467e6fcb378a67bcb52760d00a

    SHA1

    ac26e69a82d643a3cf5386dd805c37d451aab6c4

    SHA256

    358846147d2cf533a376f2aa44f0ac3dcb5072f0b35f717936f0b86e0340b8bf

    SHA512

    b85afb80c245a2d9828971e3da43b0e078cce40d287fcf2a92c8a1ea8f2989ea2b90321f5504d544fbc8f3ba03dd449e6c4b84a5e643d97ec017d65281997235

  • memory/1968-56-0x0000000075141000-0x0000000075143000-memory.dmp

    Filesize

    8KB