Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/02/2023, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
bd4a5d4a-a7f8-4efc-bb0d-a5ce7306c35d.tmp
Resource
win7-20230220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd4a5d4a-a7f8-4efc-bb0d-a5ce7306c35d.tmp
Resource
win10v2004-20230220-en
3 signatures
150 seconds
General
-
Target
bd4a5d4a-a7f8-4efc-bb0d-a5ce7306c35d.tmp
-
Size
2B
-
MD5
99914b932bd37a50b983c5e7c90ae93b
-
SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
-
SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
-
SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\tmp_auto_file\shell\edit rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\tmp_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\tmp_auto_file\shell\edit\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\tmp_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\tmp_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\tmp_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\tmp_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.tmp rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.tmp\ = "tmp_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\tmp_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\tmp_auto_file\shell\open\command rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1424 1048 cmd.exe 28 PID 1048 wrote to memory of 1424 1048 cmd.exe 28 PID 1048 wrote to memory of 1424 1048 cmd.exe 28 PID 1424 wrote to memory of 804 1424 rundll32.exe 29 PID 1424 wrote to memory of 804 1424 rundll32.exe 29 PID 1424 wrote to memory of 804 1424 rundll32.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\bd4a5d4a-a7f8-4efc-bb0d-a5ce7306c35d.tmp1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bd4a5d4a-a7f8-4efc-bb0d-a5ce7306c35d.tmp2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\bd4a5d4a-a7f8-4efc-bb0d-a5ce7306c35d.tmp3⤵PID:804
-
-