Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31/12/2022, 14:07

General

  • Target

    ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe

  • Size

    1.4MB

  • MD5

    1093f21e1c080dc2783ebbee82e0d52a

  • SHA1

    48f9fabb109460fd9267d793a147a925ea90ea9f

  • SHA256

    ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf

  • SHA512

    5df02a4183f40b9fb636a5f1acf412fc414bd55623f13a15f1f9c1a3a368411a62d5f60e660f59b975830c57e69459dec9c2ba8e2dace4a4c8f92cf6d412e38f

  • SSDEEP

    24576:zry2uXzmwLNE0F/8bJtV5fNZoIXSIKVs8Eel9ufnMKQGSengXUBa8/QJI4eQEMmE:zuny8/81X5V6YeV/KQGzgXUc8/lM5bV

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe
    "C:\Users\Admin\AppData\Local\Temp\ec2b965ff0ec20cfb8fea731ad178935ea247d65a26559db1ce870495efeeebf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5004
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /y .\8JEN.5
      2⤵
      • Loads dropped DLL
      PID:4012

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8JEN.5

    Filesize

    1.4MB

    MD5

    c214fcc3a99663225f600e4fdff37ac2

    SHA1

    b54378e2231fbba9bf5193761f345377a57d0c3c

    SHA256

    93b89c0cd6ba75e37ad1843679287f688e695e5cd9c95ff8aa41dc6733304cbe

    SHA512

    73b69eb470274c4620b50b59b0742941d0426085f83d406622a7bda19ee52f244bf47ae43f4bfbc2c99c8dcda8ce59f40a17bb0a3061724e093d965f3adb8a9d

  • \Users\Admin\AppData\Local\Temp\8jEn.5

    Filesize

    1.4MB

    MD5

    c214fcc3a99663225f600e4fdff37ac2

    SHA1

    b54378e2231fbba9bf5193761f345377a57d0c3c

    SHA256

    93b89c0cd6ba75e37ad1843679287f688e695e5cd9c95ff8aa41dc6733304cbe

    SHA512

    73b69eb470274c4620b50b59b0742941d0426085f83d406622a7bda19ee52f244bf47ae43f4bfbc2c99c8dcda8ce59f40a17bb0a3061724e093d965f3adb8a9d

  • memory/4012-237-0x0000000000E00000-0x0000000000EAE000-memory.dmp

    Filesize

    696KB

  • memory/4012-238-0x0000000000E00000-0x0000000000EAE000-memory.dmp

    Filesize

    696KB

  • memory/5004-146-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-150-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-117-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-118-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-120-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-121-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-123-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-124-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-125-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-126-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-128-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-127-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-130-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-129-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-131-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-132-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-133-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-134-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-135-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-136-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-137-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-138-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-139-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-140-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-141-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-142-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-143-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-144-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-145-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-115-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-116-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-147-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-157-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-148-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-151-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-152-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-153-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-154-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-155-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-156-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-149-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-158-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-159-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-160-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-161-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-162-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-163-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-164-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-165-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-166-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-167-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-168-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-169-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-170-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-171-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-172-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-173-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-174-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-175-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-176-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-177-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-178-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-179-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB

  • memory/5004-180-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

    Filesize

    1.6MB