Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2023, 19:49

General

  • Target

    file.exe

  • Size

    1.1MB

  • MD5

    7a66992f14ec9015181ed2d580c190ff

  • SHA1

    9674bf45d8017f7753ddd6e106a8974bb87860c0

  • SHA256

    34d3c6e0521570cf69ae828b240b19b3314e9b63d534d9a62ce81f6ac5eee8f7

  • SHA512

    e499c16f7cd9516e72745618443630bc9ca0218bc31118c49dde9ca63ffb067e65fd8b62c0326c80204156ffc030d1163910440197905be7333f64f056776dc7

  • SSDEEP

    24576:bEpFFe69Mk7fdcsaiWsEzJqIV9oM2PiUbDUrs5n9e78PB5I7QQq:bE0Ns0EQ9oMAiyDUrs5k7cB5EQ

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qytyaworpiotpd.tmp",Edoqqdswdffqipe
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23799
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1032

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Qytyaworpiotpd.tmp

    Filesize

    752KB

    MD5

    710af73b2d7e92d33fac751318c08101

    SHA1

    2208c96a528b1d96e18ae47ab274f303e4099fff

    SHA256

    72021339c18f79141f9867c30616cbbdc517471e44d16bfe81063e5c7dba56c3

    SHA512

    1f19138b8412b871ccf33ec351d28157b6571bc02cb1d338fc4c06bd77e9518bbdb3392d63b9bcdde2bd94746c232f90b4796363f83cecfd49e0470b6495ac1a

  • \Users\Admin\AppData\Local\Temp\Qytyaworpiotpd.tmp

    Filesize

    752KB

    MD5

    710af73b2d7e92d33fac751318c08101

    SHA1

    2208c96a528b1d96e18ae47ab274f303e4099fff

    SHA256

    72021339c18f79141f9867c30616cbbdc517471e44d16bfe81063e5c7dba56c3

    SHA512

    1f19138b8412b871ccf33ec351d28157b6571bc02cb1d338fc4c06bd77e9518bbdb3392d63b9bcdde2bd94746c232f90b4796363f83cecfd49e0470b6495ac1a

  • memory/1032-70-0x00000000001A0000-0x000000000044A000-memory.dmp

    Filesize

    2.7MB

  • memory/1032-80-0x0000000001FB0000-0x000000000226B000-memory.dmp

    Filesize

    2.7MB

  • memory/1032-79-0x00000000001A0000-0x000000000044A000-memory.dmp

    Filesize

    2.7MB

  • memory/1032-78-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

    Filesize

    8KB

  • memory/1032-77-0x0000000002270000-0x00000000023B0000-memory.dmp

    Filesize

    1.2MB

  • memory/1032-76-0x0000000002270000-0x00000000023B0000-memory.dmp

    Filesize

    1.2MB

  • memory/1716-66-0x0000000004420000-0x0000000004F7B000-memory.dmp

    Filesize

    11.4MB

  • memory/1716-73-0x0000000005040000-0x0000000005180000-memory.dmp

    Filesize

    1.2MB

  • memory/1716-68-0x0000000005040000-0x0000000005180000-memory.dmp

    Filesize

    1.2MB

  • memory/1716-81-0x0000000004420000-0x0000000004F7B000-memory.dmp

    Filesize

    11.4MB

  • memory/1716-67-0x0000000005040000-0x0000000005180000-memory.dmp

    Filesize

    1.2MB

  • memory/1716-65-0x0000000004420000-0x0000000004F7B000-memory.dmp

    Filesize

    11.4MB

  • memory/1716-72-0x0000000005040000-0x0000000005180000-memory.dmp

    Filesize

    1.2MB

  • memory/1716-69-0x0000000005040000-0x0000000005180000-memory.dmp

    Filesize

    1.2MB

  • memory/1716-74-0x0000000005040000-0x0000000005180000-memory.dmp

    Filesize

    1.2MB

  • memory/1716-63-0x0000000004420000-0x0000000004F7B000-memory.dmp

    Filesize

    11.4MB

  • memory/2040-55-0x0000000076041000-0x0000000076043000-memory.dmp

    Filesize

    8KB

  • memory/2040-54-0x0000000001E30000-0x0000000001F11000-memory.dmp

    Filesize

    900KB

  • memory/2040-60-0x0000000000400000-0x0000000000523000-memory.dmp

    Filesize

    1.1MB

  • memory/2040-59-0x0000000001F70000-0x0000000002090000-memory.dmp

    Filesize

    1.1MB

  • memory/2040-57-0x0000000001E30000-0x0000000001F11000-memory.dmp

    Filesize

    900KB