Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2024, 19:02

General

  • Target

    14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe

  • Size

    55KB

  • MD5

    528c6f5d8ede1d1eb5acb13aa281dff6

  • SHA1

    88f5e195f63abe727d885371fbf85960105afcfc

  • SHA256

    14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f

  • SHA512

    20b960670962314d4adf842a7887b6724387bba98689592dda99c846de13eefc31c92bc2ba970fa6271d54ec3fd0bd92d9ba68e251d33e7d7c123c1d723284a4

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw/x/fxRfxCZj1hcaEWcxINgjn+4O:V7Zf/FAxTWOx/fxRfxCZj1hcaEWAIy+x

Score
9/10

Malware Config

Signatures

  • Renames multiple (3773) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe
    "C:\Users\Admin\AppData\Local\Temp\14490dd6e9ed2443da41fe50089935928c37abc7b9a7f78e0536bcb51230cb8f.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

    Filesize

    56KB

    MD5

    2e626226e954fe251ff7162710f072a8

    SHA1

    5debb6ab94c2cc760774a983b117c830e2633939

    SHA256

    939cb2d126d63cfebf9e7571da512b11a707361e26e55e412432713aac0fad26

    SHA512

    34cb903975433f5ad1c76bccc996dbfb9d0fc8f899eab42b051d22060e1b7c17c4c0c14d82d9ee004f13775539a245eed79b9317b51385499dc624ccfa9329a2

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    65KB

    MD5

    335a9f723f2cc180cb20a122c14f0ca1

    SHA1

    ca893b03e50025d7a4e7568b2b52e278a941180c

    SHA256

    4aef022ebd85a9d20726f41576d9eb11e33374df42f8b5c35831ef519f70d38a

    SHA512

    8c5dcc48d53e567a66f1568e156dc1e46004762584b91ed7fe595b5920ef08c2cab73d80053cdf2874acd370d1aaeec63021cc3cc56c473a4ae20ea5449b9500

  • memory/2416-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2416-666-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB