Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 22:03

General

  • Target

    4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe

  • Size

    168KB

  • MD5

    8b8f7619d9c06f6167a8c6ba7dee0580

  • SHA1

    61d45145859b4ded93169e88544fc2d2dd649ba1

  • SHA256

    4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0

  • SHA512

    e9bffd6d740d777cec6bd9f498137587fa7a0187c18c30039da07daeae29ef92a1ab1e0a09c42a5e1a6a62843c663c008494b3ba5f9520099e2e53612a1df52a

  • SSDEEP

    3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIuE:JiQSo1EZGtKgZGtK/CAIuZAIuE

Score
9/10

Malware Config

Signatures

  • Renames multiple (871) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
    "C:\Users\Admin\AppData\Local\Temp\4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4940
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3964

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

      Filesize

      168KB

      MD5

      3139b01af7d06555243d3ca9d7525156

      SHA1

      f36fb657b5106166fff6acc8cd2089eea80553c0

      SHA256

      7e4a0d89cafa661810fd5961c3cde86875d6899baa2a60120412f5a16df16470

      SHA512

      c463f2a45ecf1c29babc4cb40e0cccc073bc0444cd8feb7020e5ff5fc128c4882acfd2a497398dd51a9bc962a4af960d764ecc84a30822212bf069ab80e55e9c

    • C:\libsmartscreen.dll.tmp

      Filesize

      168KB

      MD5

      751cec9fc2b0bc49ebd94b050bb9a442

      SHA1

      c07b141a102f61456603bb64b97dc4e27f45cadb

      SHA256

      63559ab32404184dc7791d9fcd975721e76497d1b00df436827713bbc3ea472f

      SHA512

      99132b1f3ae8a821a7553247881f311edb7325954c6ce26135437e9e1c3c91d867dcf874000fab3905c218ae59a65ce7eeb9da5769e63fc8d6065997e26eaa77

    • memory/4940-0-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/4940-342-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB