Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 01:08

General

  • Target

    a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe

  • Size

    165KB

  • MD5

    82aa132a94d3d8439cdd950fefa887df

  • SHA1

    13a3ad819ede8226df4184f120f2c1dee3349c4d

  • SHA256

    a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b

  • SHA512

    43eafc0a9faa87d6c587211cfe5dd54e3ab752e94f5cd16d2ebaf22442727d0eca2addbd0cfeaacd3701e22fbe120c104990e2ef511c80a0c8d3ba860eb07417

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJBn:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuX

Score
9/10

Malware Config

Signatures

  • Renames multiple (3185) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe
    "C:\Users\Admin\AppData\Local\Temp\a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    166KB

    MD5

    1cffd36829d5bd8c73c90778d2946045

    SHA1

    8bd1373ba952aeb2e3fcd18efb83dc36a7483fcd

    SHA256

    887665405695ad2a1c41dd106b54a67ec805bc9f6a9e41f0f7f9a331000e54b8

    SHA512

    d43181231d67268d1b1c892d9bb83d874f3912b317750c02ec575780243596503ee82acde3ed50daf4dfbc8c8168bc84e111bb5c009ebd2b56022431e6c53c81

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    175KB

    MD5

    50a467307f1c04e504521dcb87d578e6

    SHA1

    94fca2fe566fa503d3cac48e752e7612530a48bb

    SHA256

    d74f0da1ad03a605bd02545df52efb1c7b0e99e8a35982a52754500d8d92bfbe

    SHA512

    1ace1aab958bc2a90f6f116303871e6cd4411e145dc923bc856909c43539b2db51a7ede366d7e12e7d6f305bf967846ab91829798f3c2681c418aadfd933cee3

  • memory/2352-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2352-74-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB