Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2024, 19:07

General

  • Target

    19d872cafec60d3c3cf512b6879dd4c351d06a4c04b7f535c31ad911fceb0faf.exe

  • Size

    51KB

  • MD5

    4c7fa30f96af5161686b8065d7dc8028

  • SHA1

    b821118e3c106aef2d48d0044d1dcc491ada8475

  • SHA256

    19d872cafec60d3c3cf512b6879dd4c351d06a4c04b7f535c31ad911fceb0faf

  • SHA512

    e57c9a6d484cdd1fc159bf585d50939a0d70e3994ea4a2c6a6acd2ef1965a24a900fac5162cf091fe6c5b33bc2d7b016124aa1c5c6cf7f8391af6fe088765e64

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzS:CTWn1++PJHJXA/OsIZfzc3/Q8zxUkI

Score
9/10

Malware Config

Signatures

  • Renames multiple (3524) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19d872cafec60d3c3cf512b6879dd4c351d06a4c04b7f535c31ad911fceb0faf.exe
    "C:\Users\Admin\AppData\Local\Temp\19d872cafec60d3c3cf512b6879dd4c351d06a4c04b7f535c31ad911fceb0faf.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    51KB

    MD5

    d4074f8536b8302c20b15793ea33c357

    SHA1

    faaa59bea849afbd324a88be33174237d211df3c

    SHA256

    29f0b90d1aa928b39d20cc0b73682e41661c10c8d6c5a8727a459dd31c7adeab

    SHA512

    1d73fa4a9cae81210292f9308114fd45c7de9d0e4204f61f7966a205b631ed4dcb17571bade5ae3d3293402d9a5d0c98083c5a2d03b07a527e5a790b9e88ce4b

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    60KB

    MD5

    c1834d92a5809a3e90d9dd5afa72db86

    SHA1

    e296c6698cde086f0d3226a1239988e502d3b5c1

    SHA256

    7c7151fc20f347724bb06a4240f92064b4c9778ec8774d50640d0f45eda9f0be

    SHA512

    9030fe859eb95e78cc635ad943c6c67f1d7e619412e0b2fa1d5954093dbe29c2936fb1c89facf22d7503d32ffbdf8cea1dd46836add60194c3ac36d959effc01

  • memory/2076-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2076-74-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB