Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
16/03/2023, 08:52
230316-ksvdaacc8y 7Analysis
-
max time kernel
600s -
max time network
413s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
16/03/2023, 08:52
Static task
static1
Behavioral task
behavioral1
Sample
CISCO MAR -2023.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CISCO MAR -2023.exe
Resource
win10v2004-20230220-en
General
-
Target
CISCO MAR -2023.exe
-
Size
224KB
-
MD5
b6404da30cc21b244a101b0a23a14709
-
SHA1
2d5ebc54fe027cada7eea7de141349229186df72
-
SHA256
1bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2
-
SHA512
a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e
-
SSDEEP
3072:X3BPXZf7nECworDBqhElSksQ9na/tK88sWR:X3znqksQRa/8vxR
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe CISCO MAR -2023.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe CISCO MAR -2023.exe -
Executes dropped EXE 2 IoCs
pid Process 1780 svchost..exe 1640 suchost..exe -
Loads dropped DLL 2 IoCs
pid Process 1588 CISCO MAR -2023.exe 1780 svchost..exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1780 svchost..exe 1780 svchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1640 suchost..exe 1780 svchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe 1640 suchost..exe 1780 svchost..exe 1780 svchost..exe 1640 suchost..exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1780 svchost..exe Token: SeDebugPrivilege 1640 suchost..exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1780 1588 CISCO MAR -2023.exe 26 PID 1588 wrote to memory of 1780 1588 CISCO MAR -2023.exe 26 PID 1588 wrote to memory of 1780 1588 CISCO MAR -2023.exe 26 PID 1588 wrote to memory of 1780 1588 CISCO MAR -2023.exe 26 PID 1780 wrote to memory of 1640 1780 svchost..exe 28 PID 1780 wrote to memory of 1640 1780 svchost..exe 28 PID 1780 wrote to memory of 1640 1780 svchost..exe 28 PID 1780 wrote to memory of 1640 1780 svchost..exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\CISCO MAR -2023.exe"C:\Users\Admin\AppData\Local\Temp\CISCO MAR -2023.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\Documents\suchost..exe"C:\Users\Admin\Documents\suchost..exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5b6404da30cc21b244a101b0a23a14709
SHA12d5ebc54fe027cada7eea7de141349229186df72
SHA2561bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2
SHA512a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e
-
Filesize
224KB
MD5b6404da30cc21b244a101b0a23a14709
SHA12d5ebc54fe027cada7eea7de141349229186df72
SHA2561bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2
SHA512a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e
-
Filesize
224KB
MD5b6404da30cc21b244a101b0a23a14709
SHA12d5ebc54fe027cada7eea7de141349229186df72
SHA2561bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2
SHA512a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e
-
Filesize
224KB
MD5b6404da30cc21b244a101b0a23a14709
SHA12d5ebc54fe027cada7eea7de141349229186df72
SHA2561bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2
SHA512a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e
-
Filesize
224KB
MD5b6404da30cc21b244a101b0a23a14709
SHA12d5ebc54fe027cada7eea7de141349229186df72
SHA2561bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2
SHA512a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e
-
Filesize
224KB
MD5b6404da30cc21b244a101b0a23a14709
SHA12d5ebc54fe027cada7eea7de141349229186df72
SHA2561bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2
SHA512a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e
-
Filesize
224KB
MD5b6404da30cc21b244a101b0a23a14709
SHA12d5ebc54fe027cada7eea7de141349229186df72
SHA2561bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2
SHA512a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e