Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

8

b072a4786f...0d.exe

windows7-x64

8

b072a4786f...0d.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    141s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2022, 05:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe

  • Size

    4.8MB

  • MD5

    05dfb9f09be3fbc1b4cf81602385b0e3

  • SHA1

    2e12eb46bc24ee10ebf164c5ae7f490a4a5be09d

  • SHA256

    b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d

  • SHA512

    e7d87739f300d9b90cf723dcc0aed8053179fda0cb4a1850dcda33fe0e604c96239ab7847989dbb320096d900a52eefe5ea45f34a63de2681f25b1c43f632c97

  • SSDEEP

    98304:8JdWr3JapUG0/vUpptbPq9DzqX8etADYAAzgSQBFnciKPqzH6/omDhz:8JdWrUrpptUDW48ArhFcdeiokp

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe
    "C:\Users\Admin\AppData\Local\Temp\b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\FSCapture.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\FSCapture.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:468

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\FSCapture.exe
    Filesize

    6.8MB

    MD5

    85c9962e5f9cb1c24d8e93dcbd113c2f

    SHA1

    89703212386cc4a90831ca42b2a1a446b4ce575b

    SHA256

    a21e2f4d98ca8247b9a4c1400553febb37e3607e050c0e1195efd78e934d65d4

    SHA512

    314543a5fda837925c0589d803fad5279722f19cbda9307e69cd5dee1e0bdb4e9745f4b33f19e585a47006999c4a220d4976f3afad9042796a2df7267e11dfa9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\Languages\FSC02.fslang
    Filesize

    178KB

    MD5

    92e8a6d15e98db5d0a699053fecce518

    SHA1

    8c7e9c7c227df28655941010b0f1d752176eefae

    SHA256

    7d60c2b39d14eac73798dc72f6949fe0f656918949513b1c7a9b049a6bff053c

    SHA512

    cab6b874d6f826dc29bc66656a6c17f6c5362810303495bcb342046a8face2e2afd739abfa574ae9626eddadb5fa13b5a1e7cee49b3065aa1340a522e02ea1cf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\fsc.db
    Filesize

    7KB

    MD5

    e9c904e95c50fb2f75770dec154c546e

    SHA1

    41106529ffb09dc4e752589c11ddb8f92864a195

    SHA256

    daea7457aa9af307179f8337ebd286a59ece673819cb137576a68792b1b594f0

    SHA512

    8e497ffbcbbd32c6f544bb393145cdb96af51ae4f457ed27f9151e1b814c8b4f2e94c75d8ccdfa9b6902fbe93429466f0cefc184b733c45f6462c1f200a22ae9

    Download Submit

  • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\FSCapture.exe
    Filesize

    6.8MB

    MD5

    85c9962e5f9cb1c24d8e93dcbd113c2f

    SHA1

    89703212386cc4a90831ca42b2a1a446b4ce575b

    SHA256

    a21e2f4d98ca8247b9a4c1400553febb37e3607e050c0e1195efd78e934d65d4

    SHA512

    314543a5fda837925c0589d803fad5279722f19cbda9307e69cd5dee1e0bdb4e9745f4b33f19e585a47006999c4a220d4976f3afad9042796a2df7267e11dfa9

    Download Submit

  • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\FSCapture.exe
    Filesize

    6.8MB

    MD5

    85c9962e5f9cb1c24d8e93dcbd113c2f

    SHA1

    89703212386cc4a90831ca42b2a1a446b4ce575b

    SHA256

    a21e2f4d98ca8247b9a4c1400553febb37e3607e050c0e1195efd78e934d65d4

    SHA512

    314543a5fda837925c0589d803fad5279722f19cbda9307e69cd5dee1e0bdb4e9745f4b33f19e585a47006999c4a220d4976f3afad9042796a2df7267e11dfa9

    Download Submit

  • memory/1508-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1508-55-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB

    Download