Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2024, 00:41

General

  • Target

    2239c540af7081328a793229c5e9a8db522e4ae93e05a17cfbe80a8a565ca72d.exe

  • Size

    41KB

  • MD5

    4e36679c91fe7fc78c8146af12af4ee0

  • SHA1

    80afb052e1cc93c2361846364555a795786661b4

  • SHA256

    2239c540af7081328a793229c5e9a8db522e4ae93e05a17cfbe80a8a565ca72d

  • SHA512

    e4588975732c17e634e3969a553ccf21363eb0a79c0e8ac02fa3bd4f231eef3bcc50e96d46b8bec727b11ea15ac97f355dbc1a534dfb845119b2e11fe84b87b6

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJjtf8WUtf8WGoj9COieQJfoj9COieQJ0:V7Zf/FAxTWoJJ2WjWpf1fb

Score
9/10

Malware Config

Signatures

  • Renames multiple (5031) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2239c540af7081328a793229c5e9a8db522e4ae93e05a17cfbe80a8a565ca72d.exe
    "C:\Users\Admin\AppData\Local\Temp\2239c540af7081328a793229c5e9a8db522e4ae93e05a17cfbe80a8a565ca72d.exe"
    1⤵
    • Drops file in Program Files directory
    PID:660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-771719357-2485960699-3367710044-1000\desktop.ini.tmp

    Filesize

    41KB

    MD5

    06b2961ec515b18b5d73cd526e63ff95

    SHA1

    fbe3bd43de5a603bed04dfca28b84e894145b47c

    SHA256

    0276721c07e93ce39b150f604f83a37ca32d774abcec6145ccce202f2c111632

    SHA512

    9b89c8f1789a87003928540735515345ce37074a23cdee927549cc151d85b6caaf75574b6450325bb7b191c0141c49c6b18da121868f7800c171fcaaebb875e2

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    140KB

    MD5

    56621136b63c0a5c8c88354bd75cfa70

    SHA1

    3ec1ced0a21285bbcbcf7ffcf3f4fd927e9ff3ac

    SHA256

    1fe855f716ac3ca93e4808a5529182989858ec68790a401b9234cd6e042e63b9

    SHA512

    6435f4f02b61d88b1fc10b55c96e64b386015e4639ae668e0d66efdcdf0cfd224e3390eb6269314c1385ceb8e8bfce5a52dc267182db9624054b406cf674de25

  • memory/660-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/660-1790-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB