Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    39s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 12:03

General

  • Target

    ea7a4d095670247045180f3797bef6f2b06d7e654af4e4cd099347cf0455e609.exe

  • Size

    195KB

  • MD5

    c9b30523b47ed3792199114f4556dd70

  • SHA1

    a0104a109a563781c21516d11aa3c7b4cef18341

  • SHA256

    ea7a4d095670247045180f3797bef6f2b06d7e654af4e4cd099347cf0455e609

  • SHA512

    727055e2bd4e75c046f13de48458501f483e6e7e6aaa2ad706200c6132916f32ab7eb53947791be758a8cc178637270d308645e9b9ddbaa9466f1824c97609f2

  • SSDEEP

    6144:B27VbpQjgkUbUDFhbrdpCKXw5cgtn2AVyA5:BA9VbUDzw5cgtNVyQ

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea7a4d095670247045180f3797bef6f2b06d7e654af4e4cd099347cf0455e609.exe
    "C:\Users\Admin\AppData\Local\Temp\ea7a4d095670247045180f3797bef6f2b06d7e654af4e4cd099347cf0455e609.exe"
    1⤵
      PID:1388

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1388-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

      Filesize

      8KB

    • memory/1388-55-0x0000000000400000-0x000000000047D000-memory.dmp

      Filesize

      500KB

    • memory/1388-56-0x0000000000400000-0x000000000047D000-memory.dmp

      Filesize

      500KB

    • memory/1388-57-0x0000000000400000-0x000000000047D000-memory.dmp

      Filesize

      500KB