Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

ac6e3d73ba...e3.exe

windows7-x64

9

ac6e3d73ba...e3.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2024, 01:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac6e3d73ba05c9b31aeff8ad1ab28d4ce22cd9664f282af3b7684e5bcdfc0ae3.exe

  • Size

    467KB

  • MD5

    8cf20207163b6c4ac6cf6dddf4ec0335

  • SHA1

    ed9d1422fc9ec20d54a16ec4cac55af7bac225bc

  • SHA256

    ac6e3d73ba05c9b31aeff8ad1ab28d4ce22cd9664f282af3b7684e5bcdfc0ae3

  • SHA512

    b3337078bcf3d27ba67d4f4c9498afa672a2424fe65ad70ae64657515ba918fcdf9de4ec5053d57fd489e703dd5b88b7c29faabe140fc596ba78df651fc2869b

  • SSDEEP

    12288:iFF2uqNUhiHOR4LucvSFSrux88ndNtJXzLFziB:iFF2PUhiHOeE8rin3thLa

Score
9/10
ransomware

Malware Config

Signatures

  • Renames multiple (3436) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac6e3d73ba05c9b31aeff8ad1ab28d4ce22cd9664f282af3b7684e5bcdfc0ae3.exe
    "C:\Users\Admin\AppData\Local\Temp\ac6e3d73ba05c9b31aeff8ad1ab28d4ce22cd9664f282af3b7684e5bcdfc0ae3.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:1744
    • C:\Users\Admin\AppData\Local\Temp\_AdobeARMHelper.exe
      "_AdobeARMHelper.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp
    Filesize

    80KB

    MD5

    3df76d9f37a5def0504e494951701d4c

    SHA1

    9ffcba4ed0bd95aec25019f8bf23b408e275fd46

    SHA256

    35895fce63d2a31aa9cf93b570b6165e279b4b49e83222ab5b897fbed690188a

    SHA512

    c94ea85e8184569f8fd6992241145eada8646e6408192cf8ba70e11a256dff35596cbe5acb87f159ccbe4d586027a72fcf1129cdb875c67ceb46285e0c813812

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_AdobeARMHelper.exe
    Filesize

    387KB

    MD5

    c18baf4d858b36dbf1e679c79c659a70

    SHA1

    f5638a26a57a9ef9dbfb0b1a324c13f2b548f308

    SHA256

    843dd18df8fd40e9e8ab2cecc52c03f2e95b0c2933162ba860d83e23c207b82c

    SHA512

    a46d780398f5066a90de5e0772a0a0f55f802dca023e8c90db271507aacec8f73a6f3a8cbd086031235e2037eab83975b68e52c17519efc4c6148b48f2ad2ee2

    Download Submit

  • \Windows\SysWOW64\Zombie.exe
    Filesize

    80KB

    MD5

    cee3d3936b76117281699bcef8345216

    SHA1

    8bb1aaf10c93a02b0340c9b57487635ff4a5a623

    SHA256

    51a4f37d183ef2d73f15442c5d6ad4e607b438ac970264470a7c8fd85c455962

    SHA512

    cb3f9b21d7e588c3edc37423f1a93b4e9ed43d859ac1cef3a62e4b9833438dc1694ae44532f235e328dedfa6a089f2c9829ab966da823790d574e22c3132bf9c

    Download Submit