Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2024, 18:39

General

  • Target

    0ea3e6322e9e804934b1036d5ccdcc2507af8bd46a976c915be0f910141db632.exe

  • Size

    159KB

  • MD5

    1dc70213b8a0530bc3370bd2902c2e1f

  • SHA1

    d3aa47e6d89772edf88071073e9871be691dc42a

  • SHA256

    0ea3e6322e9e804934b1036d5ccdcc2507af8bd46a976c915be0f910141db632

  • SHA512

    1803e55db092a78bc25384e24db774c8e590940773351859aff86fd5428f1fc36468a751df9e018291c4b17ab27b9460e001fbcc748474b4df2bab37dbc6d8f1

  • SSDEEP

    3072:+nymCAIuZAIuYSMjoqtMHfhflixiE5gbez:JmCAIuZAIuDMVtM/jS

Score
9/10

Malware Config

Signatures

  • Renames multiple (4836) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ea3e6322e9e804934b1036d5ccdcc2507af8bd46a976c915be0f910141db632.exe
    "C:\Users\Admin\AppData\Local\Temp\0ea3e6322e9e804934b1036d5ccdcc2507af8bd46a976c915be0f910141db632.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2860750803-256193626-1801997576-1000\desktop.ini.tmp

    Filesize

    159KB

    MD5

    945d39a7bc90510ed53d480c7f150d2b

    SHA1

    adcd3390a698239676490f33f05777634930d5dd

    SHA256

    f132dd0c68fbbf97a9738d0f2c32c4b71df6a3323e2e421e13ca6fc512e969f8

    SHA512

    e19e9317a376fe39c582eeb88101755ef6ea4c704f36eb0d0b2654477fcd2772cb30fb5793b54f1c4e1659b65489f1593c36d14b4d9979f4d4c6c089a1bb6ccc

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    258KB

    MD5

    728fa49f230f2aa2e5ce514012777a6d

    SHA1

    43aa5277e978bed9c91d76a04651f881447cd7b2

    SHA256

    d5be0203773b3cc0e405516d668a69f26c8f3cafcb45a1459e9efe72be6a8175

    SHA512

    6d36d6b89a1c552608f0ab86ec0f338b1612c43bd4fe88accb4ac9a13f4334636b397cc5c6d2c710daa48701382d1587ee67b4f1086b8c150a9fdfe8691ed859

  • memory/1524-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1524-1640-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB