Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 01:44

General

  • Target

    2024-05-26_bc8af94da54bd2186b8191dcae5e3cfe_avoslocker_revil.exe

  • Size

    6.5MB

  • MD5

    bc8af94da54bd2186b8191dcae5e3cfe

  • SHA1

    89587077e0439431a59d21f817a809194d8d9899

  • SHA256

    adbc7b6e43968e643fc9abb2495b3f02d5fc23d551ade588a09de368b2450858

  • SHA512

    fb7635f7fd70357b1ff4e60a27237b0694bd018cfb6395e48d5aee37c623b7acf8f770b53852d4296bfb9bdacd7202d44ae59bb07bc1b14b055bfebc57f06076

  • SSDEEP

    98304:6I9tiSH6a6gfFCZ8th/yp3qvZ4ypOKRxoBBTxBQk6dtQ4:6AH6aff4+4p84yjRyBNxqQ4

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_bc8af94da54bd2186b8191dcae5e3cfe_avoslocker_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_bc8af94da54bd2186b8191dcae5e3cfe_avoslocker_revil.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\22a2e184c9fe48609d3c851a39e0cd7f.exe
      "C:\Users\Admin\AppData\Local\Temp\22a2e184c9fe48609d3c851a39e0cd7f.exe" --01
      2⤵
      • Executes dropped EXE
      PID:2016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\22a2e184c9fe48609d3c851a39e0cd7f.exe

    Filesize

    6.0MB

    MD5

    02e6bf47f5315e8da515ccae63f58a6e

    SHA1

    3469eec2964080610b188eceabc216a5f0244d2b

    SHA256

    aad9c5c01c5c87d33da0695c53eb0bdae432d41452a2f54ddc1f23eb14928517

    SHA512

    949bf7ff8eaa37a0c036af580f6bde633aec5336312f1c96d879aaf2398ee05f82a9d84ce002937b95382bedf2e7143e894b8d0feec478d074a1a3e1baf1d031

  • memory/1680-0-0x000007FEF4B5E000-0x000007FEF4B5F000-memory.dmp

    Filesize

    4KB

  • memory/1680-1-0x000007FEF48A0000-0x000007FEF523D000-memory.dmp

    Filesize

    9.6MB

  • memory/1680-2-0x000007FEF48A0000-0x000007FEF523D000-memory.dmp

    Filesize

    9.6MB

  • memory/1680-3-0x0000000000B90000-0x0000000000BBE000-memory.dmp

    Filesize

    184KB

  • memory/1680-4-0x0000000000390000-0x000000000039A000-memory.dmp

    Filesize

    40KB

  • memory/1680-11-0x0000000000160000-0x0000000000170000-memory.dmp

    Filesize

    64KB

  • memory/1680-12-0x000007FEF48A0000-0x000007FEF523D000-memory.dmp

    Filesize

    9.6MB