Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

15/01/2025, 20:36

250115-zd3tfawjan 10

15/01/2025, 20:34

250115-zcjzyavrfl 10

15/01/2025, 20:30

250115-zamm2svqhq 10

15/01/2025, 18:58

250115-xmgw8atjal 10

Analysis

  • max time kernel
    37s
  • max time network
    38s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-uk
  • resource tags

    arch:x64arch:x86image:win11-20241007-uklocale:uk-uaos:windows11-21h2-x64systemwindows
  • submitted
    15/01/2025, 20:36

General

  • Target

    ad31ca449f285250368196306a8ad77a.dll

  • Size

    5.0MB

  • MD5

    ad31ca449f285250368196306a8ad77a

  • SHA1

    abefa604d54027fac646df910a9ecbc462b01ec2

  • SHA256

    962caf150b14b5804de96484e8b911f93fcb26ab11f7e713d3f0c02a211c2577

  • SHA512

    57700c858fd9f1b3bea65af6a75fc9770a8b7b98ae195b3d53d62a4d315012ea28cc28a4e2e7dc55e137e5611cf049f0cfe4ffc6110e3bfe22a437cb52af7c15

  • SSDEEP

    49152:Sn+qMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:++qPoBhz1aRxcSUDk36SAEdhvxWa9

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 52 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad31ca449f285250368196306a8ad77a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad31ca449f285250368196306a8ad77a.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:3516
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 8
            5⤵
            • Program crash
            PID:4252
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:1636
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3516 -ip 3516
    1⤵
      PID:3408
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /0
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1036

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\mssecsvc.exe

      Filesize

      3.6MB

      MD5

      1da4aa17d6682e2224513e559e86d658

      SHA1

      435b8d0afb90a66bc63eaf9fdb5b1ce27d56dacd

      SHA256

      63500b6a365a6e688afecdf632ea399b6e80529c17d292f1f1839a1c26dfed3d

      SHA512

      bf6993555e3f9ad33ef275db233e80baf7ddf5f66c288fca2cf9cbc24ad6716df50f987a987d1c6abbd851bcc7cb29263c80fe0e43ae9e9ea4c0f9235224a89f

    • C:\Windows\tasksche.exe

      Filesize

      2.0MB

      MD5

      4cf1595972413914ee36c92584da1c4f

      SHA1

      2106ca6dde83ca404ef9b00d998fd8b58628e3fb

      SHA256

      156cae52162f94349ad25c4c2833769b20290aa5e48109479e8dd035b094f8bd

      SHA512

      08c5068f30c09e0941c60521ecbe69f4be537db3adaae47026e903f8466067347fcd522f37e9d56c464d0913f3b008038bba1d0fc83637ba0e176bd24fcedb9b

    • memory/1036-8-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB

    • memory/1036-9-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB

    • memory/1036-10-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB

    • memory/1036-14-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB

    • memory/1036-16-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB

    • memory/1036-20-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB

    • memory/1036-19-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB

    • memory/1036-18-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB

    • memory/1036-17-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB

    • memory/1036-15-0x00000213D8E00000-0x00000213D8E01000-memory.dmp

      Filesize

      4KB