Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

066d06ca00...81.exe

windows7-x64

10

06d6f22d02...bc.exe

windows7-x64

8

09f1d49065...d1.exe

windows7-x64

10

208cca124d...45.exe

windows7-x64

10

241f67ece2...79.exe

windows7-x64

1

30616f6c48...60.exe

windows7-x64

10

44f28cd6ea...7e.exe

windows7-x64

3

4b190a407b...5f.exe

windows7-x64

10

72ddceebe7...6b.exe

windows7-x64

9

7b53a00b3a...b2.exe

windows7-x64

7

7cf39ebb44...57.exe

windows7-x64

10

8c42a08427...51.exe

windows7-x64

7

9d081b734c...91.exe

windows7-x64

4

b25cc31472...15.exe

windows7-x64

10

b2ec72de35...8f.exe

windows7-x64

6

b4c2ffccfe...dd.exe

windows7-x64

5

bab7af3306...be.exe

windows7-x64

9

c531015ec0...86.exe

windows7-x64

8

dc7ab2e7ed...60.exe

windows7-x64

8

debfd1fb34...d8.exe

windows7-x64

8

df36e2aaae...37.exe

windows7-x64

9

df99316e57...27.exe

windows7-x64

4

e60fc4473a...60.exe

windows7-x64

10

Analysis

  • max time kernel
    837s
  • max time network
    844s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 19:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72ddceebe717992c1486a2d5a5e9e20ad331a98a146d2976c943c983e088f66b.exe

  • Size

    268KB

  • MD5

    4e2b58f99ad9f13c2b09f0741739775d

  • SHA1

    6a51d0cd9ea189babad031864217ddd3a7ddba84

  • SHA256

    72ddceebe717992c1486a2d5a5e9e20ad331a98a146d2976c943c983e088f66b

  • SHA512

    dd74f94fbe6324410e832ab22b2807bbc5bc4171704477898a2b64a1ce6a7b3a289a4fb399412152b33a6b286e439c8d89eca4d5cba7bcd65dcb864e18487ebd

  • SSDEEP

    3072:gfLB0w+Wv5pa/Dc/nuOL23e8aoeE+aqfnfj59AEYfzaBUGm+0lh831QPfrwV6cFK:+TgenuOLCL+559AEq+m+jmEIcFaNtN

Score
9/10
defense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (8633) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Clears Network RDP Connection History and Configurations 1 TTPs 4 IoCs

    Remove evidence of malicious network connections to clean up operations traces.

    defense_evasion
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\72ddceebe717992c1486a2d5a5e9e20ad331a98a146d2976c943c983e088f66b.exe
    "C:\Users\Admin\AppData\Local\Temp\72ddceebe717992c1486a2d5a5e9e20ad331a98a146d2976c943c983e088f66b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Users\Admin\AppData\Local\Temp\72ddceebe717992c1486a2d5a5e9e20ad331a98a146d2976c943c983e088f66b.exe
      "C:\Users\Admin\AppData\Local\Temp\72ddceebe717992c1486a2d5a5e9e20ad331a98a146d2976c943c983e088f66b.exe"
      2⤵
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\__tF029.tmp.bat
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin.exe Delete Shadows /All /Quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2500
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
          4⤵
          • Clears Network RDP Connection History and Configurations
          • System Location Discovery: System Language Discovery
          PID:2856
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
          4⤵
          • Clears Network RDP Connection History and Configurations
          • System Location Discovery: System Language Discovery
          PID:2568
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2584
        • C:\Windows\SysWOW64\attrib.exe
          attrib Default.rdp -s -h
          4⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:2636
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\__t24B1.tmp.bat
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:620
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin.exe Delete Shadows /All /Quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1984
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
          4⤵
          • Clears Network RDP Connection History and Configurations
          • System Location Discovery: System Language Discovery
          PID:2000
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
          4⤵
          • Clears Network RDP Connection History and Configurations
          • System Location Discovery: System Language Discovery
          PID:2928
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1436
        • C:\Windows\SysWOW64\attrib.exe
          attrib Default.rdp -s -h
          4⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1908
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c .bat
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:1484
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

3
T1070

Clear Network Connection History and Configurations

1
T1070.007

File Deletion

2
T1070.004

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini
    Filesize

    1KB

    MD5

    5be15a115fb4cac961088201343d8305

    SHA1

    90bc7467b7959d378622c71be9f00948f91c2c85

    SHA256

    302d2be6c278204ae5091fbd17980826456641d94a031f01796d01fdf26008aa

    SHA512

    9680b0fcb6d1cb68cce151bd545d24877caefd7a09d9fcc8a51ea8274ba67607bfa0c7ed8df12f99ce1e613509f8dd4caad135f33e2f6502c295579653599a06

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\.bat
    Filesize

    256B

    MD5

    e0e7a234622905ee483a9a2ad7135333

    SHA1

    d3129978de0570f88ded2c6be3d952547e968c60

    SHA256

    668463de3ef9c95912d0d3bd3b367895201fc5ba5338dbd033368885e639b9c4

    SHA512

    e4cfc88019ed7d5de5747935b91938fac2660210bcf15ca7f739537cc0d519a61b8de6825c3df7b9010f188deab76ce1819ac857b0a3f25ecad521491c6dc28b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__tF029.tmp.bat
    Filesize

    445B

    MD5

    32d8f7a3d0c796cee45f64b63c1cca38

    SHA1

    d58466430a2bba8641bd92c880557379e25b140c

    SHA256

    1a6f73b5c28d1c10f63f2056068c1de61487b8cf8f1dcf7516548df144b3e9ea

    SHA512

    288213b92a03ac750ea319bb23c52e7bdf47f5a47ecb70c905c7610a84c63a3ec0a30801b5880e6def8df2c9f577082072e342198d23a19f64e561923e1ef698

    Download Submit

  • C:\Users\Public\Videos\RECOVER-FILES.html
    Filesize

    4KB

    MD5

    388b7fff1cda149842c6bebb315a0436

    SHA1

    99ff909294a8482ba94f9ddeadc7afe8de9cc54a

    SHA256

    ac52e354109e524631f3894b27d9d81081ef0226e0805105b4de7cb7d9c7f2ab

    SHA512

    80a93ba95ef22b291785e84268babc2380c07a883256e7574d11e3218374d46e568b380f76b6ce076280b262e44b5a9acca55080974c5ddd12aa5f191c29865f

    Download Submit

  • memory/2484-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-4-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2484-6-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2484-9-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2484-1632-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2484-18070-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2656-1-0x0000000000520000-0x0000000000620000-memory.dmp

    Filesize

    1024KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.