Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 20:38

General

  • Target

    37d985033cb0b1a6a8299e83338cf61a9c3235d871d960dd7e2a0699d11734b4.exe

  • Size

    42KB

  • MD5

    2a8609b26b2b0693030312c10394988d

  • SHA1

    e783ccaa24e918fddffaffef2a1d4d2aadc5e46d

  • SHA256

    37d985033cb0b1a6a8299e83338cf61a9c3235d871d960dd7e2a0699d11734b4

  • SHA512

    a030361258fa7fce96874f74eefcc9a2591eabf2c974c13c4baf10f52939a21e1f7c4727f1b62c8fe72d9a337301cdd69f78d4aa8c0a24f3b7a106439fc3444e

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJjtf8WUtf8WGoj9COieQJfoj9COieQJe:V7Zf/FAxTWoJJ2WjWpf1f9

Score
9/10

Malware Config

Signatures

  • Renames multiple (3779) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37d985033cb0b1a6a8299e83338cf61a9c3235d871d960dd7e2a0699d11734b4.exe
    "C:\Users\Admin\AppData\Local\Temp\37d985033cb0b1a6a8299e83338cf61a9c3235d871d960dd7e2a0699d11734b4.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    42KB

    MD5

    2ce2ed4fbc7936e744efab36f6c0ccaa

    SHA1

    d669cc8ae3b3fcab49fb05389a2380091e505867

    SHA256

    d093075c305d231901bcf4ce9db325e29bf0f6e1ef71c24a74b114906196bda0

    SHA512

    b0dd26fb65d1fb71334d4c0d0683c967b27168928224ec3af2651063e4d43ed6858df17e22775e4b0ee5071e4b7e2dcfc0c2a654641712805467ffc0d73166e6

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    51KB

    MD5

    55c4d8161657859651bdc3668958d0d6

    SHA1

    32101d0fa29dc6ebbeaa39075f9615ca5843acd5

    SHA256

    49c16c3b314efefb970be434734fe3e025b5f9aa04ac70a05d3d471100434263

    SHA512

    1d99e6418a5ed9dae95243e45a0165144f122aadf0d0da9fdce57d05e7c43aec71c9110ab7d9b6baf7a9034d212e6d3b4eb756fdb60ddd226c06d21d58baaa7b

  • memory/2368-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2368-648-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB