Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    29/06/2024, 04:00

General

  • Target

    ddfdea201fe17ea90bee5794596bda9e474186fe898d8da90b82d97da721bbcb.exe

  • Size

    97KB

  • MD5

    3f9b37767afd5cafd9aa095472387fa4

  • SHA1

    7ca3ff6a175a7eda1468e2a1fffe315d06fb7fc7

  • SHA256

    ddfdea201fe17ea90bee5794596bda9e474186fe898d8da90b82d97da721bbcb

  • SHA512

    68ebd4f23a31a01043255d457066c28318e4e64b2aab94b7c305bd0aec78ea8d4d5933fab50edfa3d596c84032af260a22b91886c38b21b58b60808e879e1421

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOVYd7n97n+tG:fnyiQSohsUsKY5Z+tG

Score
9/10

Malware Config

Signatures

  • Renames multiple (3467) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddfdea201fe17ea90bee5794596bda9e474186fe898d8da90b82d97da721bbcb.exe
    "C:\Users\Admin\AppData\Local\Temp\ddfdea201fe17ea90bee5794596bda9e474186fe898d8da90b82d97da721bbcb.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

    Filesize

    97KB

    MD5

    eabea8fef7bae830df4dbd193d6e1c65

    SHA1

    241a79f991c5f5229a415dff87bc4c90b6b3a9ea

    SHA256

    6aef44bf32b3c575e1db7b84e204c79fdd683716c5d9aa253394144fefb0413d

    SHA512

    bc8381d257bd0349de84a653bed6a8f20e22dda2daaf9c775d5fa5700bf8e88d3338a3adbb79f38ca994a31da4eaa808a63f12e27b8619f8ce798e13b56f34be

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    106KB

    MD5

    57acd12d2bd5885027cdff3c109b39fe

    SHA1

    052e67e94f9a72c078c6fcf45304bb17d0e8fa76

    SHA256

    1d1df61ebcf168cfd559ad9c803831b496ff00ee83e5cafefa9985b3bf4ec9cb

    SHA512

    6a355c4fcd92de9b1a8263960ca623e9cde80aa01733242b19bb6e841cf7f25ec2f0808de261abab3c6b5400742b9ffa17d68f0c09e7ce4a5927069a53542237

  • memory/2728-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2728-658-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB