Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 04:02

General

  • Target

    c86277b0f432cfa8ef56e07a6c1ea7f4872d5fa1b2ff417a7d6feedf867eba61.exe

  • Size

    103KB

  • MD5

    e2d01fdff3134be581bdf24b4416a414

  • SHA1

    accf13225735862a98040b6b506e46e0e5e67891

  • SHA256

    c86277b0f432cfa8ef56e07a6c1ea7f4872d5fa1b2ff417a7d6feedf867eba61

  • SHA512

    08576fc4e4b343c180f29e12c916068eb3ea8baf9c7b9b6a9923798bdb74004d768e7958a1956eaa1b7eba1b04aed35e189d02149af504489a8adebd435a0d63

  • SSDEEP

    1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf0xW:hfAIuZAIuYSMjoqtMHfhfH

Score
9/10

Malware Config

Signatures

  • Renames multiple (4692) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c86277b0f432cfa8ef56e07a6c1ea7f4872d5fa1b2ff417a7d6feedf867eba61.exe
    "C:\Users\Admin\AppData\Local\Temp\c86277b0f432cfa8ef56e07a6c1ea7f4872d5fa1b2ff417a7d6feedf867eba61.exe"
    1⤵
    • Drops file in Program Files directory
    PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

    Filesize

    104KB

    MD5

    0c2f5dc3d3630d5273f11f2020d1c525

    SHA1

    b1a4952cbe973cd971a8ced9bd09ddc13098cd52

    SHA256

    439b9ede0a4df4dcab89bb8a2073e7d172f46792fd814231f9d88c302058ea61

    SHA512

    a0fd6d1c81b954515a02cce459409944871ac6028b9ac252d6aaca4fcb27574576a011fcc2c44c65f098623a0fb90b9859d872ba5aa5d10f99192589003944e3

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    202KB

    MD5

    fa0c34ed7800e1c259a3a1fc29b2f178

    SHA1

    551f4b7b565ac7cc9e45a33f28205d5c8afd7d8d

    SHA256

    05670bf1e0e25ffb52a8637edc215b42e3dc8c1bf2fb281a01654f0bfe1a8209

    SHA512

    b101d895d0775ef15d5f5056c195d17e279d82b9a0acf6e5311e0bec70ae172dfe46e0eb34673e8b4c881c25e0c7f6e2af2ed1ea12ad783ab6df1479c1d09528

  • memory/932-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/932-860-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB