Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/04/2024, 02:02

General

  • Target

    bc79958373d59c8d46ce20429c86ce9e19862ce788c701008e11c2c90530497b.exe

  • Size

    127KB

  • MD5

    3837d49e71ab0234325ce429fa22be8f

  • SHA1

    59c67c47ba36bbf047fad856e69ac5fb5d4565ae

  • SHA256

    bc79958373d59c8d46ce20429c86ce9e19862ce788c701008e11c2c90530497b

  • SHA512

    81ce955f4096b7e9e74d1ba2c739b7e8209a366751f75d07ffd5cd867e13324df9b23d1560e02eb58f1454a7f4717d857830b4b2adee78a75051a66d544bc337

  • SSDEEP

    1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCi:+nymCAIuZAIuYSMjoqtMHfhf5SskG

Score
9/10

Malware Config

Signatures

  • Renames multiple (3435) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc79958373d59c8d46ce20429c86ce9e19862ce788c701008e11c2c90530497b.exe
    "C:\Users\Admin\AppData\Local\Temp\bc79958373d59c8d46ce20429c86ce9e19862ce788c701008e11c2c90530497b.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

    Filesize

    128KB

    MD5

    09c00f113fdcfbdeff1ec68f6cf30656

    SHA1

    ac6d6965b81c3463b4c8f8d251e114949883f9b0

    SHA256

    f333164c93b1ea759626fad2b56c1e227a6c6b313784fc1c680f9523457daadd

    SHA512

    fd0a6c3e8dde3ff00af939b1739126429137aea0752e46078c8112a097ba7faa2f7965adedafc8858f8574a2dd870897f0377626b4bccdb7047200b8440d0d34

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    137KB

    MD5

    476aa4266f4cccc285081f13b24894b4

    SHA1

    e72976ea40a18d08bfc02fd8bf6f03184ec08f85

    SHA256

    0299339e2ab3e2e96b0046f14d3210987406d5361888c984a7a16e9fdd8344af

    SHA512

    6f4d8f581f5ebed88e191a0c95e177578fcf50b892868afd070e3d3d9d5fa8c80ab1bec3cfaf50d6e6a6b1da6fd7c5aef5c01b204da01bb31ae8196806a3601f

  • memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3000-618-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB