Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 04:05

General

  • Target

    3c07efcd6472668b62d9c77d18daf9a2c540a1357550302bd2f6c7f2f294f06e.exe

  • Size

    241KB

  • MD5

    9d6304e9d6e12b2e74f3e744ffd3c350

  • SHA1

    87ad73482c27fd6e3ebc39f5bbe1f3be0b915860

  • SHA256

    3c07efcd6472668b62d9c77d18daf9a2c540a1357550302bd2f6c7f2f294f06e

  • SHA512

    01f111a3e57c580d9a47da7e461c44dd9bf4b869b8ff9ca843c267c9ddc814d38b26f82ec7a9b1f88ddae80491535d213b3003faa5e9babbf00de54a2cab1dc9

  • SSDEEP

    3072:fnyiQSo7Z54HZKMx4dhECVTQSo7Z54HZKMx4dhECVH:KiQSoz4HUK4dh5TQSoz4HUK4dh5H

Score
9/10

Malware Config

Signatures

  • Renames multiple (4682) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c07efcd6472668b62d9c77d18daf9a2c540a1357550302bd2f6c7f2f294f06e.exe
    "C:\Users\Admin\AppData\Local\Temp\3c07efcd6472668b62d9c77d18daf9a2c540a1357550302bd2f6c7f2f294f06e.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

    Filesize

    241KB

    MD5

    91f39a1ea52fcc2069c70e2a7169568d

    SHA1

    c2f86a82b2698076bb98a73b47e251ef7e7aa310

    SHA256

    ffa5048a054a80735b7cf5b57082faecdf7b0d5a04ca92f43184ec8cb2bed585

    SHA512

    1fce4f6adeb9c59bf7d5d75f431700047cd2a7dc9f4cd8a76afb59ace920f271538765cee154f4b0150ad065d3f5066d473abd95048b7f0b6bb0f9be4219010e

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    340KB

    MD5

    ce5892411d478e184d9df2eca7da7ef1

    SHA1

    aa37bfb0523d7462745fa63175fa92d9474c1571

    SHA256

    f35e31ce5b949a6f4c9e89f37921810d12c3e504c7637b0ce1bf5506bc771e36

    SHA512

    ca4339780e358822500f72a740e90bc11961192128e278406d12b088e90d9aefd31343f481e34602b792494cb70018c3e97904848fbdab3c627e62fae80b636e

  • memory/1508-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1508-1642-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB