Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
09/03/2024, 18:20
General
-
Target
bc7c1e69bf363517d13a1ebd20a4ea7a.exe
-
Size
3.3MB
-
MD5
bc7c1e69bf363517d13a1ebd20a4ea7a
-
SHA1
f19254a24dc5a0ae100e716ff501b55eaad8e2e7
-
SHA256
8dede2a22514223dbcb639a6a0b6a96e747728cdaf447bdf112166da0156ae96
-
SHA512
7871c61f7137720ea1be192e3cc1c68ee3f7d15e7358cdc5c5ec8e5d9e609a5a2b21de35c77741e99666618301c28c25e72045f8a603fd1ceed50ad45a1cc8c3
-
SSDEEP
12288:gp4pNfz3ymJnJ8QCFkxCaQTOl2GVqCw+VsLkjrVlQB9FbDTF53nlNFRpO50w9XCC:aEtl9mRda1VICwE
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc7c1e69bf363517d13a1ebd20a4ea7a.exe"C:\Users\Admin\AppData\Local\Temp\bc7c1e69bf363517d13a1ebd20a4ea7a.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5ffd757631b49031c825ed0be86b437a7
SHA145596aae34fb98f5bc4dfcda888fc13a9a32c1db
SHA25656d8f40039eef00760db806feb9c483a44ac65cadf37a9b76b8cb8f49c29190d
SHA512035294f1ca271abec075de1f74529ffb4d3994f6bde3f7efa2ee0b4fc8b5a951006a30257e34c6c2df51bc6c905c8b355efede535886462f3e140e2ae7f0fcb2
-
Filesize
1KB
MD5a69718bddf5b513a8de8757d55c480fd
SHA115522f36065974e0beadff19a86b9482e151c1fc
SHA2563138394cef042962da0280db4bfacc64d80fea5932dbf60a5c794b335dd5caa5
SHA512ef011a72b9bbe0beaf73e0ee005b74d2b0b06b3f01a6d115f28b1992dd12927d945d44d632296a533c8935236c98841d48c6dd9a241fdbd6825c0232cd7d500b
-
Filesize
950B
MD529552f2541501af261e7c5209c243881
SHA1bfb52435d28cf4579049059f57a5b3178db3a202
SHA256a0da6e9779d49bbed170ac92600976cfedaabe922f8bcc1d43a7adc1ce04a5f8
SHA51237207bd5152cdf5052178c311c6119815603fd6500754aef918fd7005e84b0528942d837289dfaa8a451d763e30c87c2a87c45d76ce77de2c75a33cd161a2616
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
3.3MB
MD5bc7c1e69bf363517d13a1ebd20a4ea7a
SHA1f19254a24dc5a0ae100e716ff501b55eaad8e2e7
SHA2568dede2a22514223dbcb639a6a0b6a96e747728cdaf447bdf112166da0156ae96
SHA5127871c61f7137720ea1be192e3cc1c68ee3f7d15e7358cdc5c5ec8e5d9e609a5a2b21de35c77741e99666618301c28c25e72045f8a603fd1ceed50ad45a1cc8c3
-
Filesize
3.3MB
MD596cbb1066324b041d7925b9a56ffea45
SHA1b5ed5421d5a4808f9711a8cfc1e5459ea4e7adde
SHA256f5f1c2f479c9cfb4d8a1c2962638e076feff5fcf74e87080c245b7bc82c34f7c
SHA5128d3de83067d7d69218fe1660038d78547acc7f19525b35f3551d4e21df462aa928b7b2def2fb5f796817ca0d6bab3d1caae69d1ba4bceebc168c9ba42a5fc959
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
482KB
-
Filesize
4KB
-
Filesize
482KB
-
Filesize
4KB
-
Filesize
482KB
-
Filesize
482KB