Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 20:46
Behavioral task
behavioral1
Sample
f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
Resource
win10v2004-20220901-en
General
-
Target
f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
-
Size
654KB
-
MD5
d1d7aadd8bf387753bd6c7501d943696
-
SHA1
7f8c251e26eeb2a932fbac229bfd471e053e4189
-
SHA256
f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5
-
SHA512
7f62d94f93de037c6abc36a7b971914409c1796a20dd20c67f43f7d6117f523f7a267a6e20120cb5faff94fc81a1b36c8381a8ccf1dc0a1f5b4208df42cd6430
-
SSDEEP
12288:h6Wq4aaE6KwyF5L0Y2D1PqLwelzrCW8Vwj/8Snw5CmzgpNrX:3thEVaPqLwex8e/dwEmsX
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1720 readme.exe 1984 svchost.exe -
resource yara_rule behavioral1/memory/788-55-0x0000000000400000-0x00000000004FA000-memory.dmp upx behavioral1/memory/788-65-0x0000000000400000-0x00000000004FA000-memory.dmp upx -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read.vbs WScript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read.vbs WScript.exe -
Loads dropped DLL 4 IoCs
pid Process 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 1720 readme.exe 1720 readme.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\read = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\read.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\read = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\read.vbs\"" WScript.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/788-55-0x0000000000400000-0x00000000004FA000-memory.dmp autoit_exe behavioral1/memory/788-65-0x0000000000400000-0x00000000004FA000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1720 readme.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 788 wrote to memory of 1720 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 28 PID 788 wrote to memory of 1720 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 28 PID 788 wrote to memory of 1720 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 28 PID 788 wrote to memory of 1720 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 28 PID 788 wrote to memory of 1492 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 29 PID 788 wrote to memory of 1492 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 29 PID 788 wrote to memory of 1492 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 29 PID 788 wrote to memory of 1492 788 f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe 29 PID 1720 wrote to memory of 1984 1720 readme.exe 31 PID 1720 wrote to memory of 1984 1720 readme.exe 31 PID 1720 wrote to memory of 1984 1720 readme.exe 31 PID 1720 wrote to memory of 1984 1720 readme.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe"C:\Users\Admin\AppData\Local\Temp\f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\readme.exeC:\Users\Admin\AppData\Local\Temp/readme.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
PID:1984
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\read.vbs"2⤵
- Drops startup file
- Adds Run key to start application
PID:1492
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD560ce7fdcf0debaab00b74c84d5295c1f
SHA1f76301f76220acd3611c14b1b6310c5600bb4497
SHA25677c14d3a8a92498e479cb579e5cf0f0a397941f0266f1f178bc2a11a88c42cad
SHA51258f828d8c124c0b1ab23830fc5f103a793ab31dddb9138dce2f1e21197cf027952da4358c54d89776c713edb12e83e93e0ca0709bb95aacbc61d1111f5112829
-
Filesize
372KB
MD5b16682ddf9bb23946228262d2cd37d55
SHA1650040332e8fe8d34fea5877a51695b2ce4a4e86
SHA25642c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e
SHA512a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933
-
Filesize
372KB
MD5b16682ddf9bb23946228262d2cd37d55
SHA1650040332e8fe8d34fea5877a51695b2ce4a4e86
SHA25642c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e
SHA512a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933
-
Filesize
372KB
MD5b16682ddf9bb23946228262d2cd37d55
SHA1650040332e8fe8d34fea5877a51695b2ce4a4e86
SHA25642c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e
SHA512a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933
-
Filesize
372KB
MD5b16682ddf9bb23946228262d2cd37d55
SHA1650040332e8fe8d34fea5877a51695b2ce4a4e86
SHA25642c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e
SHA512a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933
-
Filesize
372KB
MD5b16682ddf9bb23946228262d2cd37d55
SHA1650040332e8fe8d34fea5877a51695b2ce4a4e86
SHA25642c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e
SHA512a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933
-
Filesize
372KB
MD5b16682ddf9bb23946228262d2cd37d55
SHA1650040332e8fe8d34fea5877a51695b2ce4a4e86
SHA25642c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e
SHA512a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933
-
Filesize
372KB
MD5b16682ddf9bb23946228262d2cd37d55
SHA1650040332e8fe8d34fea5877a51695b2ce4a4e86
SHA25642c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e
SHA512a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933