Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2024, 22:08 UTC

General

  • Target

    202409239fb28246a02994cd745c6881065f0fb6blackcatmauinokoyawavenuslockerwannacry.exe

  • Size

    13.9MB

  • MD5

    9fb28246a02994cd745c6881065f0fb6

  • SHA1

    b2cc8f434e6fb012dbdae89d7c8b1d8ea95a7ad3

  • SHA256

    d8e9e06b7adea939bcc135876f4e8a1d3719120e8ad9d4d72812ffd1dbee62fc

  • SHA512

    134416ccd29ce4fcd4db8116112884581020ac289f9813ad5c399c5d2aa963b1a8f23c8cb1ec4028c596e8112a2e51dbc222cca5156ae0da824b20f223427f3e

  • SSDEEP

    98304:aRqeZPPm0Rgmt7M17Lu1zdfj7zyg5oo5AZx8U8qPoBhLTlL4DQWVYHL9fu4h84Mu:aMygJ9edfbhSo5Kp8qPKlL8QgYVhqhG

Malware Config

Signatures

  • Azov

    A wiper seeking only damage, first seen in 2022.

  • Renames multiple (1875) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\202409239fb28246a02994cd745c6881065f0fb6blackcatmauinokoyawavenuslockerwannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\202409239fb28246a02994cd745c6881065f0fb6blackcatmauinokoyawavenuslockerwannacry.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:1964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

    Filesize

    2KB

    MD5

    78ede93114e65f9160fd03d3357c56e6

    SHA1

    88d531b101e57655f1d0d26c6b3257aa2468d460

    SHA256

    c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5

    SHA512

    074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

  • memory/1964-8-0x0000000000300000-0x0000000000305000-memory.dmp

    Filesize

    20KB

  • memory/1964-10-0x0000000000300000-0x0000000000305000-memory.dmp

    Filesize

    20KB

  • memory/1964-6-0x0000000000310000-0x0000000000314000-memory.dmp

    Filesize

    16KB

  • memory/1964-5-0x0000000000300000-0x0000000000305000-memory.dmp

    Filesize

    20KB

  • memory/1964-4-0x0000000000170000-0x0000000000177000-memory.dmp

    Filesize

    28KB

  • memory/1964-3-0x0000000000300000-0x0000000000305000-memory.dmp

    Filesize

    20KB

  • memory/1964-2-0x0000000140000000-0x000000014003E000-memory.dmp

    Filesize

    248KB

  • memory/1964-0-0x0000000000310000-0x0000000000314000-memory.dmp

    Filesize

    16KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.