Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    92s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 02:49

General

  • Target

    cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6.exe

  • Size

    71KB

  • MD5

    924823d2d6ecf7aee10096f9ec44c25e

  • SHA1

    30cd8822a6647f14f17e38568e4edbdae38e25b8

  • SHA256

    cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6

  • SHA512

    93b856c76668dd7d50f5c62c3952974048fe965a48832fd4491aebb08ff546dfc7710bbe798e71a4018c1ecf3cd706f65716e762221dbc5685957d0a048b1640

  • SSDEEP

    768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFmzWzXUK:67Zf/FAxTWY1++PJHJXA/OsIZpPEIUu

Score
9/10

Malware Config

Signatures

  • Renames multiple (4860) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6.exe
    "C:\Users\Admin\AppData\Local\Temp\cbcfd6b5c1e1aeb9dcd174e7a221231b2895658489e241c542bbee27e2e670e6.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

    Filesize

    71KB

    MD5

    a3305633f0553cc231b1e33366683393

    SHA1

    9b440fc5c9d5e3dea1966145f16d4a53ae37b29f

    SHA256

    956a782f3bce14923782bb3929051f8831ad6b86409fd4ef36de8bce16e17c1f

    SHA512

    371fa1fcc02ab841f134533f224eedc019b9a07868703c0a51b52bb0a469eebbec5897d95d57d472a56da2ee23e43020efc5835bf12c5775e99dd07adba5569b

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    170KB

    MD5

    e93303affb3692bbecdecdf51638b0b8

    SHA1

    e6e88d332c2d815b23a5ceba6dd09b390b7d7afa

    SHA256

    a81efc96e8efd7e56cbf43ecc244b564cb57ab1d99e4e223f1ae5603a0bd7ed9

    SHA512

    5b3c3d05e9312c1b69e5f6cb52183b070f2f2bb69cef5d981b3d5ddc7dca56f003df775b83ca98688c70a766750c46f6694fe4bc173c18d8b28faaab0813276e

  • memory/3968-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3968-1776-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB