Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
11/01/2023, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
253dc675eceaf5e241df64306d0de350af4715a0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
253dc675eceaf5e241df64306d0de350af4715a0.exe
Resource
win10v2004-20220901-en
General
-
Target
253dc675eceaf5e241df64306d0de350af4715a0.exe
-
Size
843KB
-
MD5
e2e8e1d58b06d7e05bef8c13bca92ab3
-
SHA1
253dc675eceaf5e241df64306d0de350af4715a0
-
SHA256
6532e16d04ebfc98395b0e06fb2c1210d5064dc242c2c374beccb6b561a58f6f
-
SHA512
227b165ff0318d71416b5125bb7ff3b5e5c0099d558563f980a9c0d9d136a21f59794a0d47522e845fb92eefaf71a62dbd3f2568a3636d4096533bfee3bbe05a
-
SSDEEP
24576:Dgh/1s5nyyx+NxEyafsab6JJH6UgLlrNsuru:ch/1s5nyC+NqyafsaGJJH6zBrNb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 1116 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe Token: SeDebugPrivilege 1116 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1576 wrote to memory of 1116 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 28 PID 1576 wrote to memory of 1116 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 28 PID 1576 wrote to memory of 1116 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 28 PID 1576 wrote to memory of 1116 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 28 PID 1576 wrote to memory of 1716 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 30 PID 1576 wrote to memory of 1716 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 30 PID 1576 wrote to memory of 1716 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 30 PID 1576 wrote to memory of 1716 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 30 PID 1576 wrote to memory of 2004 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 31 PID 1576 wrote to memory of 2004 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 31 PID 1576 wrote to memory of 2004 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 31 PID 1576 wrote to memory of 2004 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 31 PID 1576 wrote to memory of 1240 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 32 PID 1576 wrote to memory of 1240 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 32 PID 1576 wrote to memory of 1240 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 32 PID 1576 wrote to memory of 1240 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 32 PID 1576 wrote to memory of 1816 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 34 PID 1576 wrote to memory of 1816 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 34 PID 1576 wrote to memory of 1816 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 34 PID 1576 wrote to memory of 1816 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 34 PID 1576 wrote to memory of 1336 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 33 PID 1576 wrote to memory of 1336 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 33 PID 1576 wrote to memory of 1336 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 33 PID 1576 wrote to memory of 1336 1576 253dc675eceaf5e241df64306d0de350af4715a0.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"2⤵PID:1716
-
-
C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"2⤵PID:2004
-
-
C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"2⤵PID:1240
-
-
C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"2⤵PID:1336
-
-
C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"C:\Users\Admin\AppData\Local\Temp\253dc675eceaf5e241df64306d0de350af4715a0.exe"2⤵PID:1816
-