Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2025, 15:49

General

  • Target

    7c7262d9e49a40a52d0040942810456c.dll

  • Size

    5.0MB

  • MD5

    7c7262d9e49a40a52d0040942810456c

  • SHA1

    11f1d0fc532dd8ac926e4ecbae734a484bccb54c

  • SHA256

    fb2ddd079c9ea48c32edc702707a2e117e076a09196deec14f3eb9bb7492d619

  • SHA512

    36ecf7c53affcbf2aaf4bd6455ad230c3f1271ab2f82036c8b557144f85724e1f8921a3e658c8076c980fcbce5224d093b7a5960d6d6671218da8e5167f877f2

  • SSDEEP

    49152:RnpENbcBVQej/1INRx+TSqTdX1HkQo6SAgqG:1p+oBhz1aRxcSUDk36SAgH

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3166) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c7262d9e49a40a52d0040942810456c.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c7262d9e49a40a52d0040942810456c.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\WINDOWS\mssecsvr.exe
        C:\WINDOWS\mssecsvr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          PID:2304
  • C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\WINDOWS\tasksche.exe

    Filesize

    2.0MB

    MD5

    97fe88aae55e849dce84bb3a105633d0

    SHA1

    8b70f9988f52b48e6c5997820215793ac31ade8f

    SHA256

    5374f0ace1103f63611d466af63c662a32f38f978358084aa763b39dccd83d2b

    SHA512

    5edf54319fbdf72783327de3e6702d2daf2ecc2997a9677939135e806bdaad1ea60c9d08dc8341b427832d704f1d232e66c159e11ebd63ef846bb966ccaa1127

  • C:\Windows\mssecsvr.exe

    Filesize

    2.2MB

    MD5

    a0a9d89096902bd94346342034c5101b

    SHA1

    0c4684c974a521cc2df6c9d654782142ca111cc3

    SHA256

    b2964fc76f83f1d7ac04a95995e2e04c4126a3026d09961232ff605144b8f175

    SHA512

    97bafcf6d0e1682fddc0723ffa7beba51bc241420ce06275c78e5427bad779426db1295c33e3f498d93d9fc5a9f45f290386e228a77db4ae8958e3f86b4c657c