Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 01:24
Static task
static1
Behavioral task
behavioral1
Sample
f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395.exe
Resource
win10v2004-20220812-en
General
-
Target
f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395.exe
-
Size
771KB
-
MD5
1fad1ea8839c05aa2416a2f10c1f95ff
-
SHA1
0ae1030f8788909ca39869ad98c66d66c4c11e49
-
SHA256
f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395
-
SHA512
0db4d48e57776fcf57e163ec7519a2058c090ae87ca36887ea5629771310a255f66979a0b1236a43ee2b062a726f56afbb235ac1961c5a223b8509b32e4714cb
-
SSDEEP
12288:waWzgMg7v3qnCiMErQohh0F4CCJ8lnyPQCY9LkWyThzW:3aHMv6CorjqnyPQh9LyhzW
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 844 2032 WerFault.exe 21 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 844 2032 f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395.exe 28 PID 2032 wrote to memory of 844 2032 f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395.exe 28 PID 2032 wrote to memory of 844 2032 f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395.exe 28 PID 2032 wrote to memory of 844 2032 f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395.exe"C:\Users\Admin\AppData\Local\Temp\f562d1ce8f3f4245f4fbb2370044fd4d6cdae05a0671fbd019d108e7805e8395.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 6962⤵
- Program crash
PID:844
-