Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 09:05

General

  • Target

    33a8da668103601848692927a5386720N.exe

  • Size

    142KB

  • MD5

    33a8da668103601848692927a5386720

  • SHA1

    ea7e113d3020f6360c3b0b6bc60ac209bf89ea77

  • SHA256

    1120d26c0db3a0d60352aa9ed55afe65ae5cfe20448c55758150997b6ea3ee03

  • SHA512

    e18026c283d8941e27a7bc8bec7fa8dd8a12324af80514d84af76eae898fc4b180915f08043741c1846c64062cdbb4d9e9038a1a3cd018bd13a92915432ad64f

  • SSDEEP

    1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCK:+nymCAIuZAIuYSMjoqtMHfhfM3A86

Score
9/10

Malware Config

Signatures

  • Renames multiple (4211) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33a8da668103601848692927a5386720N.exe
    "C:\Users\Admin\AppData\Local\Temp\33a8da668103601848692927a5386720N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2480455240-981575606-1030659066-1000\desktop.ini.tmp

    Filesize

    142KB

    MD5

    684d1aa02fdd9ee19f7ba3d3569f3848

    SHA1

    3c7ed8ede95971f9d4813736290e0d5f2c837b55

    SHA256

    665dc574a348cdf25a0ea22f290ff85f82d863b5bf11b2c2b480de467976b63f

    SHA512

    5f90137105f90c5056223aec807baebbe5228c63fd6949483befaaff335bf9b7585f28e8cf7dfb8387a862102ae847888025cd113e992d4467692924869e2ba8

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    241KB

    MD5

    4c6208b7026dce63cc7a4f277ba08f64

    SHA1

    85d5f67c0904e5313a39dd09177aaa510ccf0bb9

    SHA256

    00bde7dfc4fa0f97412afb49714915a97261f3aedd331babc936b3d630ab16b3

    SHA512

    ea515701302868b1fa14976dd735243bc039f3e96f6db606fcf2f3e7e743e8a77173d3844029c6507a62e1d40eeed79001ff245f48847c2b7b4d297ef0a46991

  • memory/3228-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3228-1508-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB