Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

tmp.exe

windows7-x64

7

tmp.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2023, 11:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    375KB

  • MD5

    8c1fdfac9ebd282be0a85164120445ae

  • SHA1

    249647954c4d28aea0f517c6831102430cd9cd3f

  • SHA256

    340c89d0d81447bbe9855d625048e84b7226beb0bc9c4cbb7cc54891449d785a

  • SHA512

    d18cae71203ca7bf8e2ab85559932a0896a139237f4732fa382aac80f3cedf514d22dd17107173ae3706eb65b1dbe35fa98d4d772dd5a13979993b0624f22a3d

  • SSDEEP

    6144:PYa6Blr2Uv5LIYxmevmwwYztxy4yY0n4Av1ZYQ9yra/EpCsMjACt+wPp6g7m1Q/r:PYzlCqY7wjx04sZ1ycV8Q+wPtCC

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe
      "C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe" C:\Users\Admin\AppData\Local\Temp\ovlmifu.st
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe
        "C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1484

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\iqayygn.dzp
    Filesize

    206KB

    MD5

    3d2b994d23fbf53a10e5d02b708b901b

    SHA1

    642201f31c3c7adf90208d5b13ef553a3a5c9a46

    SHA256

    29c66e8e087271ac091326936c796454cc0961ab6f5805c9a91cd087894b9a8b

    SHA512

    a2638b327a7742653f2ec8c56359eb8c934f91f687e83118676220ccf83d24f21f60d9256acfbccc9337c22ada47d1ba2ab70806676b8b2b16e1078cbfab77ad

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe
    Filesize

    323KB

    MD5

    720c9c0fa6c97ff562bd780799354bea

    SHA1

    81a64489fe39f0669812506734386a68089b321d

    SHA256

    b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f

    SHA512

    eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe
    Filesize

    323KB

    MD5

    720c9c0fa6c97ff562bd780799354bea

    SHA1

    81a64489fe39f0669812506734386a68089b321d

    SHA256

    b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f

    SHA512

    eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lgrjzad.exe
    Filesize

    323KB

    MD5

    720c9c0fa6c97ff562bd780799354bea

    SHA1

    81a64489fe39f0669812506734386a68089b321d

    SHA256

    b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f

    SHA512

    eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ovlmifu.st
    Filesize

    5KB

    MD5

    1888157b960f14ecc9a310dc35bca5ad

    SHA1

    73cfaadd5c99ea41bb8bd27441898a63f7c31251

    SHA256

    0fdeb156d6ec7bbfba51f0167d7ce92b31b2aa862eaac92db52de594ce3460df

    SHA512

    df0035e7f672a2f00c81e3a2e287798b6b979a1f5527faa387418092b75c2a8151a893597453afbf8942b3d656b55d52ad0b415e3e0352c889e32942a6d685bc

    Download Submit

  • \Users\Admin\AppData\Local\Temp\lgrjzad.exe
    Filesize

    323KB

    MD5

    720c9c0fa6c97ff562bd780799354bea

    SHA1

    81a64489fe39f0669812506734386a68089b321d

    SHA256

    b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f

    SHA512

    eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5

    Download Submit

  • \Users\Admin\AppData\Local\Temp\lgrjzad.exe
    Filesize

    323KB

    MD5

    720c9c0fa6c97ff562bd780799354bea

    SHA1

    81a64489fe39f0669812506734386a68089b321d

    SHA256

    b957df3ad091d5012b8490c42a2044b9e754ee4300aa2bca54d95500a7aadb2f

    SHA512

    eca45676d11eef6e2836881dc0e6ed8b3f0b918fba5e8bb17372ce06cc619e9e1f389189f1c4fc4d9468320172c3b3e369643fb22f3533ec1dcb5d6e14c796a5

    Download Submit

  • memory/1484-65-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1484-68-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1484-69-0x00000000006F0000-0x00000000009F3000-memory.dmp

    Filesize

    3.0MB

    Download

  • memory/1484-70-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download