Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2023, 03:53

General

  • Target

    Big hacker official tool v69 64bit.exe/7zm_JZ_Cert.pfx

  • Size

    4KB

  • MD5

    6119ecc99c5e2b2d5de44bb2694e665f

  • SHA1

    74c9089cb994eb986cb55cc8ef791ebae84f769e

  • SHA256

    9af12fe326ec847b0fb6579ca0daa7f45057917766790396c6164f335d52ae17

  • SHA512

    1b5c0a50ffb7fdfa4031571ad651c9fd9b02162d81da8122bd6f0d0737e942f2872e48c7188ef6c400ccab4beade6e0a54f640a69840a2447eeae0144fc6b31d

  • SSDEEP

    96:X4nlDOueyw8O2F0Jo3YFuVm33jm91m+8R3+P5BWfFc7wtX:X44uel8O2F0tFuVm3y9t43qWtc7UX

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Big hacker official tool v69 64bit.exe\7zm_JZ_Cert.pfx"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtAddPFX C:\Users\Admin\AppData\Local\Temp\Big hacker official tool v69 64bit.exe\7zm_JZ_Cert.pfx
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1500

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1356-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

    Filesize

    8KB