Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

winprofile

windows7-x64

8

winprofile

windows10-1703-x64

8

Analysis

  • max time kernel
    248s
  • max time network
    251s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/12/2022, 04:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe

  • Size

    1.0MB

  • MD5

    bb233d4542a170be01c2d14cbb4a1d8a

  • SHA1

    3f5b38c62ab67eb8612af6280294b524d94891cd

  • SHA256

    5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

  • SHA512

    fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

  • SSDEEP

    24576:8RVbNR6HnOroQkHwiO7bw0mFR+0rRLgLJ1sbw1vhY:kT8HjQkQ1nmFRryLJ1sGv

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
    "C:\Users\Admin\AppData\Local\Temp\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5028
    • C:\Users\Admin\AppData\Local\Temp\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
      C:\Users\Admin\AppData\Local\Temp\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3; Set-MpPreference -ExclusionPath C:\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3344
  • C:\Users\Admin\AppData\Roaming\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
    C:\Users\Admin\AppData\Roaming\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1032
    • C:\Users\Admin\AppData\Roaming\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
      C:\Users\Admin\AppData\Roaming\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2352

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe.log
    Filesize

    1KB

    MD5

    46b9a10350d1fde974a2790b29fe6db1

    SHA1

    839298607712b2983d9f2d2e039be472990a9277

    SHA256

    dd5343fbe5976d7a4ed13699bd76b127acf08d34386259a7cf430059a0618852

    SHA512

    dcd98039c87de071e9c5dec00b078521758d7525ff98ce2b33e6885d71b95dbd54444d3eba331701014674d4626468c401870718efe3cf2a3c187c0316be54d7

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    3KB

    MD5

    56efdb5a0f10b5eece165de4f8c9d799

    SHA1

    fa5de7ca343b018c3bfeab692545eb544c244e16

    SHA256

    6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

    SHA512

    91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    6fc28be2695480fd979d775f71c265ad

    SHA1

    bc8862dca5806d2d4f977893c2512799de45cdc9

    SHA256

    763b76e7f1163ee012e32fe0ac27b4b52bcfad5a7d0c3ac6e41e8d162294e2f9

    SHA512

    be899373df1962cad8050af557882e582d99c657cddf21f2126472f1e260fa18f6e9774b5717ac2f8ad3671c3c5be7665e6666d158d60b8e5f4eaa1eb02f1880

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    240B

    MD5

    c66b8cf322bbfec932d4840ac87ca09d

    SHA1

    12c726f460e2eaf4d5c66734386e9195b08dd87b

    SHA256

    b8c3d655f288ab81571663e2f7abca32b5bf8072e6c4fecd3a00c86916d920cd

    SHA512

    2bdabd21e9703c8f1e6321a69583c35cb84b04378df486d7cae71476e7f22e036b0ef9e1187c25c11e503cf896064d1b7fc2a6ece79be734566897ec6bf4477d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
    Filesize

    1.0MB

    MD5

    bb233d4542a170be01c2d14cbb4a1d8a

    SHA1

    3f5b38c62ab67eb8612af6280294b524d94891cd

    SHA256

    5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

    SHA512

    fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
    Filesize

    1.0MB

    MD5

    bb233d4542a170be01c2d14cbb4a1d8a

    SHA1

    3f5b38c62ab67eb8612af6280294b524d94891cd

    SHA256

    5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

    SHA512

    fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352.exe
    Filesize

    1.0MB

    MD5

    bb233d4542a170be01c2d14cbb4a1d8a

    SHA1

    3f5b38c62ab67eb8612af6280294b524d94891cd

    SHA256

    5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

    SHA512

    fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

    Download Submit

  • memory/1524-158-0x000002923B1F0000-0x000002923B282000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1524-157-0x0000029253950000-0x0000029253A54000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1736-119-0x0000020F48400000-0x0000020F48422000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1736-116-0x0000020F2DE10000-0x0000020F2DF14000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1736-118-0x0000020F48330000-0x0000020F483C2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1736-117-0x0000020F2FA50000-0x0000020F2FB54000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/2836-135-0x0000000140000000-0x0000000140078000-memory.dmp

    Filesize

    480KB

    Download

  • memory/2836-141-0x00000249493B0000-0x0000024949404000-memory.dmp

    Filesize

    336KB

    Download

  • memory/2836-140-0x00000249309E0000-0x0000024930A2C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2836-139-0x0000024949250000-0x00000249492A6000-memory.dmp

    Filesize

    344KB

    Download

  • memory/2836-138-0x00000249491B0000-0x0000024949250000-memory.dmp

    Filesize

    640KB

    Download

  • memory/5028-127-0x00000240E72F0000-0x00000240E7366000-memory.dmp

    Filesize

    472KB

    Download