Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2022, 01:07

General

  • Target

    9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe

  • Size

    179KB

  • MD5

    79372dcbf9858b005729da221561b2aa

  • SHA1

    a499819f0659340a5d9ea72d4aa3c2189908551a

  • SHA256

    9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1

  • SHA512

    baef407ec4dac0fa792932546bd762c5d9c3e360f281ce4014700115946ff04560c09499e72a1ce4fc28940cd86080ddf8fdb41a4bbc599e00e432a28949855b

  • SSDEEP

    3072:ABAp5XhKpN4eOyVTGfhEClj8jTk+0hvXUDFY/2g3xrpr:3bXE9OiTGfhEClq9QUDF2

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
    "C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\1\2\sogazr.bat" "
      2⤵
      • Drops file in Drivers directory
      PID:1728
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\daet.vbs"
      2⤵
      • Blocklisted process makes network request
      PID:1664
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\ekstaz.vbs"
      2⤵
        PID:1548

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\1\2\daet.vbs

      Filesize

      547B

      MD5

      232aa0068739f14ea68404c1dcb71929

      SHA1

      c70a0711fd6b9f38260b1c6dcb43e97ca2ad06a7

      SHA256

      8530396ddc8187a992d6561d04cb8a1726acf9ec299452e5395ac3aefce8d95b

      SHA512

      67717519e6df96404468a0a4af3ff7b3af5c136b7715f5955b6ddebc4b7ffae8d1c679d782511843e694336c2e6ec62e1a55af99d64c46adec20f777caca9d23

    • C:\Program Files (x86)\1\2\ekstaz.vbs

      Filesize

      588B

      MD5

      89031d9b74652f0be426774267586b8d

      SHA1

      7fd55000c315bcbd55ff51ed7b0ca201e978a8dc

      SHA256

      b50e00e042f97ad4e848444c9b2281e9dbb03dec367b53fcbe376e54c1e8fd4b

      SHA512

      fa0f2b5d94a14934c5ff100ef90c8a4af8686abeb4b67f02fc15d25f5181ec705b2182e22ed88be8647e5d87e5467db5f6a4d04d71edb55ff167a64e9cd5f40f

    • C:\Program Files (x86)\1\2\kids.txt

      Filesize

      5B

      MD5

      8249407cf0da9a987b8d09ce7f4d2979

      SHA1

      73c63d88a3fc1f87e6c66e437b458c1826efca8e

      SHA256

      d9caa2357f1ea7b8b1d10caf71f96e52e19b7446f017eea5f197710b650938a2

      SHA512

      f6d066137a051bee999489167da6f31d5a71ef0a127f286f8aebb2a9cc9f2437a06b37e5e5b671bd0344fbec45c79c6b8ddb2b1ab797a9a08bbb017d00fd6d26

    • C:\Program Files (x86)\1\2\sogazr.bat

      Filesize

      3KB

      MD5

      eadc34423f9258a670719eb7e2897f6a

      SHA1

      8a3a364c70fb77148c345a709f62dece838900e0

      SHA256

      033ace201e06b89a6689dd64f61afb047fbdf1bf10d0d96b8a2bc2de9ae77560

      SHA512

      bf2981bab0604962e235dbad6422b7d779bdf63e1578ba2a61f9f894c0a72725e809d6b1d1364642b6d4411c7183711bfad1a6a9efb86e014f5d692d3df20b9e

    • memory/1132-54-0x0000000075931000-0x0000000075933000-memory.dmp

      Filesize

      8KB