Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 02:49

General

  • Target

    cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6.exe

  • Size

    71KB

  • MD5

    924823d2d6ecf7aee10096f9ec44c25e

  • SHA1

    30cd8822a6647f14f17e38568e4edbdae38e25b8

  • SHA256

    cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6

  • SHA512

    93b856c76668dd7d50f5c62c3952974048fe965a48832fd4491aebb08ff546dfc7710bbe798e71a4018c1ecf3cd706f65716e762221dbc5685957d0a048b1640

  • SSDEEP

    768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFmzWzXUK:67Zf/FAxTWY1++PJHJXA/OsIZpPEIUu

Score
9/10

Malware Config

Signatures

  • Renames multiple (3508) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6.exe
    "C:\Users\Admin\AppData\Local\Temp\cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6.exe"
    1⤵
    • Drops file in Program Files directory
    PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

    Filesize

    71KB

    MD5

    bffa15948a2b8914183291fceb95f981

    SHA1

    73496668c46ec4c42b3861ec68a95c534f2167bb

    SHA256

    36a0050188bd389f03285a01ae65766a6d95505fa9d78c90aa1cfec7aeb9a67f

    SHA512

    62c4ab2c49779d0f78dfbcdb41b77bfdd6c846dac62c2f084bd687e87ed4bddf2b5e8df218e88e35b5d39f78624d04e92395949a3d31520c3f0f7419ec46571e

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    80KB

    MD5

    1ada76d54782e28e5832d8d8d4bc96bb

    SHA1

    727958d4fafe52828e8048ceb537b24ff75f9bb2

    SHA256

    6dc622129858fd46af1f6d8934c04e029a2d04732d7131b1d3c430dbed0bf4c3

    SHA512

    4f7f9729163583d305b0719095449cafb8ec5e41ed5cffd66f19f7577cc0dfe44001d01f6ca196828e6b94a41742ebb52a874258acc9d1776d126ca26abca176

  • memory/992-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/992-652-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB