Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03/04/2023, 05:56
Static task
static1
Behavioral task
behavioral1
Sample
PO_Scan Document.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PO_Scan Document.exe
Resource
win10v2004-20230220-en
General
-
Target
PO_Scan Document.exe
-
Size
433KB
-
MD5
e3f21a7a4a879db45f6e3feeb8d43c5e
-
SHA1
2d198951d904596d300933714f24acdcc796fe77
-
SHA256
97ba4422534cfd514e9dff46d3fb40efeb33ed2ad0ab29dee8a312453049203d
-
SHA512
5db796f7fe1574646c3de6cabf022eca4db30155f9120c37f73e92e485c5b09e4664bb8a254332474c35a0c4ea3d5ff9ed5f8a74fdea0f3ed4b420c9a0d77288
-
SSDEEP
6144:vYa6T3YS/vfoY2wXVVfY5Pv8wsD9QkiF2VIBn1AyxhOiMshL3Qlk1OkoyoV3OCcn:vY5XswlVfmPs+ktIB1T7vhhn4Fr+CYt
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1964 tjhnnq.exe 980 tjhnnq.exe -
Loads dropped DLL 3 IoCs
pid Process 2000 PO_Scan Document.exe 2000 PO_Scan Document.exe 1964 tjhnnq.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1964 set thread context of 980 1964 tjhnnq.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 980 tjhnnq.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1964 tjhnnq.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 980 tjhnnq.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1964 2000 PO_Scan Document.exe 28 PID 2000 wrote to memory of 1964 2000 PO_Scan Document.exe 28 PID 2000 wrote to memory of 1964 2000 PO_Scan Document.exe 28 PID 2000 wrote to memory of 1964 2000 PO_Scan Document.exe 28 PID 1964 wrote to memory of 980 1964 tjhnnq.exe 29 PID 1964 wrote to memory of 980 1964 tjhnnq.exe 29 PID 1964 wrote to memory of 980 1964 tjhnnq.exe 29 PID 1964 wrote to memory of 980 1964 tjhnnq.exe 29 PID 1964 wrote to memory of 980 1964 tjhnnq.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_Scan Document.exe"C:\Users\Admin\AppData\Local\Temp\PO_Scan Document.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\tjhnnq.exe"C:\Users\Admin\AppData\Local\Temp\tjhnnq.exe" C:\Users\Admin\AppData\Local\Temp\iezebs.zxo2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\tjhnnq.exe"C:\Users\Admin\AppData\Local\Temp\tjhnnq.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:980
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD583e5ccb6cd81eebfa8e66bad63bcde94
SHA1a26c811d29ae9828cae8b834b41475064b5a709a
SHA256b6694d8973b3e7ce6743b757523597ac6cc1a7b30c56e8ddc2ca8a8731d11caf
SHA512c477699ff8e7fbbe3aed887dd344eb7a8e961dc65822a82b090125d0ae6382bf229596afd4380f015d907964e3f850dcb5f2f5cf3e237486ec1c5beb519b7672
-
Filesize
496KB
MD530dba8ef430fe7c6ec4657cfceca7bf9
SHA1a7cb1ff28fc58340f1388df0b9da3db9572b5404
SHA2562c412d7854e6d58f9eb59887b8b7106f3df63a892372298f41eec4bed094f43c
SHA512b3ba18fc592760697777a0eb00247600435f80fb2981c640d13c9ba0aca184470a198c4c1a13c4e093f34691c9dabef0f231a31d1b838b4046f30b1ef11d9fc8
-
Filesize
34KB
MD52734f85c7824ff0cc4174e3420fd13be
SHA1655439976de7158592eb74a030b2542219231390
SHA2566078aaec77239e228fc1bdb7b5c15e4ebd78b03c8905fe2b9aee2b9edac52247
SHA51266d3a53b5f1a10e1dae36f95b067553496a7437bac0f5eba34574d43cd2052c8b54a01c4c840a77ab3049a9ed45dea095e0e93e045a3eab4bd16e9c0230f01ec
-
Filesize
34KB
MD52734f85c7824ff0cc4174e3420fd13be
SHA1655439976de7158592eb74a030b2542219231390
SHA2566078aaec77239e228fc1bdb7b5c15e4ebd78b03c8905fe2b9aee2b9edac52247
SHA51266d3a53b5f1a10e1dae36f95b067553496a7437bac0f5eba34574d43cd2052c8b54a01c4c840a77ab3049a9ed45dea095e0e93e045a3eab4bd16e9c0230f01ec
-
Filesize
34KB
MD52734f85c7824ff0cc4174e3420fd13be
SHA1655439976de7158592eb74a030b2542219231390
SHA2566078aaec77239e228fc1bdb7b5c15e4ebd78b03c8905fe2b9aee2b9edac52247
SHA51266d3a53b5f1a10e1dae36f95b067553496a7437bac0f5eba34574d43cd2052c8b54a01c4c840a77ab3049a9ed45dea095e0e93e045a3eab4bd16e9c0230f01ec
-
Filesize
34KB
MD52734f85c7824ff0cc4174e3420fd13be
SHA1655439976de7158592eb74a030b2542219231390
SHA2566078aaec77239e228fc1bdb7b5c15e4ebd78b03c8905fe2b9aee2b9edac52247
SHA51266d3a53b5f1a10e1dae36f95b067553496a7437bac0f5eba34574d43cd2052c8b54a01c4c840a77ab3049a9ed45dea095e0e93e045a3eab4bd16e9c0230f01ec
-
Filesize
34KB
MD52734f85c7824ff0cc4174e3420fd13be
SHA1655439976de7158592eb74a030b2542219231390
SHA2566078aaec77239e228fc1bdb7b5c15e4ebd78b03c8905fe2b9aee2b9edac52247
SHA51266d3a53b5f1a10e1dae36f95b067553496a7437bac0f5eba34574d43cd2052c8b54a01c4c840a77ab3049a9ed45dea095e0e93e045a3eab4bd16e9c0230f01ec
-
Filesize
34KB
MD52734f85c7824ff0cc4174e3420fd13be
SHA1655439976de7158592eb74a030b2542219231390
SHA2566078aaec77239e228fc1bdb7b5c15e4ebd78b03c8905fe2b9aee2b9edac52247
SHA51266d3a53b5f1a10e1dae36f95b067553496a7437bac0f5eba34574d43cd2052c8b54a01c4c840a77ab3049a9ed45dea095e0e93e045a3eab4bd16e9c0230f01ec
-
Filesize
34KB
MD52734f85c7824ff0cc4174e3420fd13be
SHA1655439976de7158592eb74a030b2542219231390
SHA2566078aaec77239e228fc1bdb7b5c15e4ebd78b03c8905fe2b9aee2b9edac52247
SHA51266d3a53b5f1a10e1dae36f95b067553496a7437bac0f5eba34574d43cd2052c8b54a01c4c840a77ab3049a9ed45dea095e0e93e045a3eab4bd16e9c0230f01ec