Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
06/12/2022, 20:23
General
-
Target
498247e68c4ee6d9582c943fd5bb0ff576c01ee76114e8845a4544fc32d1aa04.exe
-
Size
2.8MB
-
MD5
fc4e2172f955b5e8f58f21ae1fa7fa75
-
SHA1
f73a95c3420c7dc4a5039c09e3d4e6af8a6e30cb
-
SHA256
498247e68c4ee6d9582c943fd5bb0ff576c01ee76114e8845a4544fc32d1aa04
-
SHA512
dfbf07be52f58620b9b1a151e05c33a6cf311cb6bfa45abc5612fb257c650b2734c3be06786651addaece0b0d7a72b55318b73521451f047b2f955f366e26af3
-
SSDEEP
49152:4k6xY5h9Vc6g1esgdVSqxmBS/nB1F9Z1FQMF/q63e1anMW5dUlga:IuTPc6g1CdzxmBSZ9xQMFnoanul
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\498247e68c4ee6d9582c943fd5bb0ff576c01ee76114e8845a4544fc32d1aa04.exe"C:\Users\Admin\AppData\Local\Temp\498247e68c4ee6d9582c943fd5bb0ff576c01ee76114e8845a4544fc32d1aa04.exe"1⤵
- Drops file in Drivers directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd /c rd "C:\Windows\system32\drivers\etcHxlVp" /S /Q2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB