Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12/01/2023, 23:33
Static task
static1
Behavioral task
behavioral1
Sample
Counter-Strike.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Counter-Strike.exe
Resource
win10v2004-20221111-en
General
-
Target
Counter-Strike.exe
-
Size
265.2MB
-
MD5
37667601ee4b53183145118c5751330e
-
SHA1
f42d970dc4b239ebb34277f96dea5b0a941d6ca9
-
SHA256
0d7bc42c56b0f0ee4bbf6e2178db5adbf145295ba4e5dee7532e1c0858ea3fe3
-
SHA512
6c7bd24eac7d5e0474ecb5583f8d66c98b5bad91cd5c2a6b26d06142a5ce0404ab0314f095ccf9751f04db27337a42b21634265364524e55689c92ce46aecf48
-
SSDEEP
3145728:9fjTxdljCmzc15qJPPZOnJlMKbAhMslm88ayBurKCGk1NxRJg8jKxePjAxxHfOnp:d1D8qJ3EAhHmbFBXk1nXPuAjYeKt79O
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 996 Counter-Strike.tmp -
Loads dropped DLL 6 IoCs
pid Process 1360 Counter-Strike.exe 996 Counter-Strike.tmp 996 Counter-Strike.tmp 996 Counter-Strike.tmp 996 Counter-Strike.tmp 996 Counter-Strike.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 996 Counter-Strike.tmp 996 Counter-Strike.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 996 Counter-Strike.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1360 wrote to memory of 996 1360 Counter-Strike.exe 28 PID 1360 wrote to memory of 996 1360 Counter-Strike.exe 28 PID 1360 wrote to memory of 996 1360 Counter-Strike.exe 28 PID 1360 wrote to memory of 996 1360 Counter-Strike.exe 28 PID 1360 wrote to memory of 996 1360 Counter-Strike.exe 28 PID 1360 wrote to memory of 996 1360 Counter-Strike.exe 28 PID 1360 wrote to memory of 996 1360 Counter-Strike.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Counter-Strike.exe"C:\Users\Admin\AppData\Local\Temp\Counter-Strike.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp"C:\Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp" /SL5="$60120,277524654,60928,C:\Users\Admin\AppData\Local\Temp\Counter-Strike.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:996
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
700KB
MD5ccd2afcc8b78a187d60d2fd9e26e2fe1
SHA1db2c8cff0e12ad35faffa8d181de31eb916e5315
SHA2564c37ea9342587b6cc9a2c64018a518fe3d8b7018550b8726f3f4377cfa0a9671
SHA512b567ea1a95586e757afe573658ff25fa19ba80977e36cb2c557afe254a9d1dd427005a3b98e01d87e63bbffa451ba618c6b951cbc0e47d68f476efaaf4f8e0b9
-
Filesize
219KB
MD5002569d719a892cefdee47b40fb9de9d
SHA1c87baaf1db6f143eafceafb0e10be366a729cff7
SHA256a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746
SHA51200f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321
-
Filesize
219KB
MD5002569d719a892cefdee47b40fb9de9d
SHA1c87baaf1db6f143eafceafb0e10be366a729cff7
SHA256a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746
SHA51200f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321
-
Filesize
219KB
MD5002569d719a892cefdee47b40fb9de9d
SHA1c87baaf1db6f143eafceafb0e10be366a729cff7
SHA256a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746
SHA51200f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321
-
Filesize
84KB
MD52098ccf443433129b556c2849fe99e26
SHA1074ddbaff48c88b3b5c8f881c35d2be2bb19a249
SHA2564a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af
SHA512fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10
-
Filesize
397KB
MD53745840b996a56366857e83cd4244d5f
SHA1fbdcc19e19aad2dadeb020447344c4c97982bc37
SHA256e4496e39b112e655b0d2f37489a3bd76c2ec72ba83c4605c3e379619e666d8ad
SHA512d35ff2980776235896bb00cdfe8d08c236787e36f55100aaebe597f4a7dde9fc5d0999792c2554398c90ad72a2e82c7c276d37f7ff32e1d00cfae703aa6170fe
-
Filesize
700KB
MD5ccd2afcc8b78a187d60d2fd9e26e2fe1
SHA1db2c8cff0e12ad35faffa8d181de31eb916e5315
SHA2564c37ea9342587b6cc9a2c64018a518fe3d8b7018550b8726f3f4377cfa0a9671
SHA512b567ea1a95586e757afe573658ff25fa19ba80977e36cb2c557afe254a9d1dd427005a3b98e01d87e63bbffa451ba618c6b951cbc0e47d68f476efaaf4f8e0b9