Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    77s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 19:46

General

  • Target

    18da91d0bb86f74e55a5388ceabd89b9f5e23fec329ccbcf5d1e50c3e2ba14e0.exe

  • Size

    624KB

  • MD5

    40eca80dee3b9b38066922b011de8c0f

  • SHA1

    3182ae618e6cd6a89d2975184eb161df1644615d

  • SHA256

    18da91d0bb86f74e55a5388ceabd89b9f5e23fec329ccbcf5d1e50c3e2ba14e0

  • SHA512

    246a57515902a9dd79b8848d9256bf9833f8839b836ba6800e673580f92eebe85634b0761d3888e9bb98ad14fef0bc1b50e642b9acd29fe38ed6e9ce08683c4e

  • SSDEEP

    3072:m55OBNpd9+QE5cujcA5RUPH09B1KNjx6QgsdGVK1T8SHgszpd9+QE5cujcA5RUPX:XqQQcPkR6HjxYK1DqQQcPkR6Hjx

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18da91d0bb86f74e55a5388ceabd89b9f5e23fec329ccbcf5d1e50c3e2ba14e0.exe
    "C:\Users\Admin\AppData\Local\Temp\18da91d0bb86f74e55a5388ceabd89b9f5e23fec329ccbcf5d1e50c3e2ba14e0.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:888
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add hkcu\software\classes\mscfile\shell\open\command /ve /d "C:\Users\Admin\AppData\Local\Temp\MouDNS2.exe" /f
      2⤵
      • Modifies registry class
      • Modifies registry key
      PID:692
    • C:\Windows\system32\cmd.exe
      cmd /c start eventvwr.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Windows\system32\eventvwr.exe
        eventvwr.exe
        3⤵
          PID:1144
      • C:\Windows\System32\reg.exe
        "C:\Windows\System32\reg.exe" delete hkcu\software\classes\mscfile /f >nul 2>&1
        2⤵
        • Modifies registry key
        PID:1484

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/888-56-0x00000000761F1000-0x00000000761F3000-memory.dmp

      Filesize

      8KB

    • memory/1144-60-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

      Filesize

      8KB