Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/12/2022, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe
Resource
win10-20220812-en
General
-
Target
ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe
-
Size
1.4MB
-
MD5
1093f21e1c080dc2783ebbee82e0d52a
-
SHA1
48f9fabb109460fd9267d793a147a925ea90ea9f
-
SHA256
ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf
-
SHA512
5df02a4183f40b9fb636a5f1acf412fc414bd55623f13a15f1f9c1a3a368411a62d5f60e660f59b975830c57e69459dec9c2ba8e2dace4a4c8f92cf6d412e38f
-
SSDEEP
24576:zry2uXzmwLNE0F/8bJtV5fNZoIXSIKVs8Eel9ufnMKQGSengXUBa8/QJI4eQEMmE:zuny8/81X5V6YeV/KQGzgXUc8/lM5bV
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4012 msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4012 5004 ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe 66 PID 5004 wrote to memory of 4012 5004 ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe 66 PID 5004 wrote to memory of 4012 5004 ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe"C:\Users\Admin\AppData\Local\Temp\ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\8JEN.52⤵
- Loads dropped DLL
PID:4012
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5c214fcc3a99663225f600e4fdff37ac2
SHA1b54378e2231fbba9bf5193761f345377a57d0c3c
SHA25693b89c0cd6ba75e37ad1843679287f688e695e5cd9c95ff8aa41dc6733304cbe
SHA51273b69eb470274c4620b50b59b0742941d0426085f83d406622a7bda19ee52f244bf47ae43f4bfbc2c99c8dcda8ce59f40a17bb0a3061724e093d965f3adb8a9d
-
Filesize
1.4MB
MD5c214fcc3a99663225f600e4fdff37ac2
SHA1b54378e2231fbba9bf5193761f345377a57d0c3c
SHA25693b89c0cd6ba75e37ad1843679287f688e695e5cd9c95ff8aa41dc6733304cbe
SHA51273b69eb470274c4620b50b59b0742941d0426085f83d406622a7bda19ee52f244bf47ae43f4bfbc2c99c8dcda8ce59f40a17bb0a3061724e093d965f3adb8a9d