Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4de14e1f14...5c.exe

windows7-x64

10

4de14e1f14...5c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4de14e1f14410aa4e3fe7dc5fddb0d5c

  • Size

    1.1MB

  • Sample

    240109-krxf9accbk

  • MD5

    4de14e1f14410aa4e3fe7dc5fddb0d5c

  • SHA1

    711b726766937fb800a72d42e446e26457f1d9c0

  • SHA256

    7208b596206e452421fa5c97cbe6ba44d5380d6fbaacd7e3fb0fd7c11b68eb89

  • SHA512

    efe6fd33f87f20df915b7db5a36f97b176c77b3f5e7af821eb068f028a11bb31d39a8ced31c6426f0935c8a980fef4c9a0bef3d531c3c61ea286eb17374e5214

  • SSDEEP

    12288:gp4pNfz3ymJnJ8QCFkxCaQTOl2GVqCw+fCbBmBCHB:aEtl9mRda1VICwoCHB

Score
10/10
persistenceransomware

Malware Config

Targets

    • Target

      4de14e1f14410aa4e3fe7dc5fddb0d5c

    • Size

      1.1MB

    • MD5

      4de14e1f14410aa4e3fe7dc5fddb0d5c

    • SHA1

      711b726766937fb800a72d42e446e26457f1d9c0

    • SHA256

      7208b596206e452421fa5c97cbe6ba44d5380d6fbaacd7e3fb0fd7c11b68eb89

    • SHA512

      efe6fd33f87f20df915b7db5a36f97b176c77b3f5e7af821eb068f028a11bb31d39a8ced31c6426f0935c8a980fef4c9a0bef3d531c3c61ea286eb17374e5214

    • SSDEEP

      12288:gp4pNfz3ymJnJ8QCFkxCaQTOl2GVqCw+fCbBmBCHB:aEtl9mRda1VICwoCHB

    Score
    10/10
    persistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks