Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 02:49 UTC

General

  • Target

    cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6.exe

  • Size

    71KB

  • MD5

    924823d2d6ecf7aee10096f9ec44c25e

  • SHA1

    30cd8822a6647f14f17e38568e4edbdae38e25b8

  • SHA256

    cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6

  • SHA512

    93b856c76668dd7d50f5c62c3952974048fe965a48832fd4491aebb08ff546dfc7710bbe798e71a4018c1ecf3cd706f65716e762221dbc5685957d0a048b1640

  • SSDEEP

    768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFmzWzXUK:67Zf/FAxTWY1++PJHJXA/OsIZpPEIUu

Score
9/10

Malware Config

Signatures

  • Renames multiple (3508) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6.exe
    "C:\Users\Admin\AppData\Local\Temp\cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6.exe"
    1⤵
    • Drops file in Program Files directory
    PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

    Filesize

    71KB

    MD5

    bffa15948a2b8914183291fceb95f981

    SHA1

    73496668c46ec4c42b3861ec68a95c534f2167bb

    SHA256

    36a0050188bd389f03285a01ae65766a6d95505fa9d78c90aa1cfec7aeb9a67f

    SHA512

    62c4ab2c49779d0f78dfbcdb41b77bfdd6c846dac62c2f084bd687e87ed4bddf2b5e8df218e88e35b5d39f78624d04e92395949a3d31520c3f0f7419ec46571e

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    80KB

    MD5

    1ada76d54782e28e5832d8d8d4bc96bb

    SHA1

    727958d4fafe52828e8048ceb537b24ff75f9bb2

    SHA256

    6dc622129858fd46af1f6d8934c04e029a2d04732d7131b1d3c430dbed0bf4c3

    SHA512

    4f7f9729163583d305b0719095449cafb8ec5e41ed5cffd66f19f7577cc0dfe44001d01f6ca196828e6b94a41742ebb52a874258acc9d1776d126ca26abca176

  • memory/992-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/992-652-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.