Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 21:04

General

  • Target

    4423f4950d3a8c8dedf5230233a26694e66b78bec5378dfc45c403730953de38.exe

  • Size

    110KB

  • MD5

    04bee44550aa144a6606ebc1ff8373ee

  • SHA1

    e616ef93926813d28371cd5697625848fc4fd69f

  • SHA256

    4423f4950d3a8c8dedf5230233a26694e66b78bec5378dfc45c403730953de38

  • SHA512

    459650fd7c0c57ca601c73df86648f5ed8829144f04fac089a9eebcbfec7a69312e47673bf64131e1ab5f400a539b9396fe12ac6d9168e639b10c3892c8caa28

  • SSDEEP

    1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf0xS:hfAIuZAIuYSMjoqtMHfhfn

Score
9/10

Malware Config

Signatures

  • Renames multiple (4830) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4423f4950d3a8c8dedf5230233a26694e66b78bec5378dfc45c403730953de38.exe
    "C:\Users\Admin\AppData\Local\Temp\4423f4950d3a8c8dedf5230233a26694e66b78bec5378dfc45c403730953de38.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

    Filesize

    111KB

    MD5

    003cab9bf10d8902ee0bc7fda913301e

    SHA1

    0da474b70b03b797afad0e930fbcad9038b66173

    SHA256

    1d95341088a7b2d4b92cd75a33d7982fc2b45afafca7e4dda776e1aac9c473f2

    SHA512

    ee81cee012ddaa245a6ded930bebdfe566ff62576a0587f60e563ad81f01519aa944270cb4009b11b1fc64420b717c2031abd14bd28023fe7c95e2754f7a8b5c

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    209KB

    MD5

    2bb4f97048d82bcc15c24a04387984eb

    SHA1

    48ada265d437dbfb05e69258cd0854935517f158

    SHA256

    2f4771a9a1ce45411064ba4abe333daa09a7732a22d8d2e2e26304b885b178fb

    SHA512

    69ce9071f80db28ceb905ead3f253856ac99c2f01c861f4423c67e9645b60204a36247dc6e4db12acf8761cc56041d5bc2b235ba2962f08e14be896fdc20f460

  • memory/4316-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/4316-924-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB