Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

b7de492efa...63.exe

windows7-x64

9

b7de492efa...63.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2024, 04:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b7de492efa8d6ff8aff98db157f16e27bb12e759f45c6a36e91ba7be70ada563.exe

  • Size

    465KB

  • MD5

    4cb8e637913dbf01188b2d8751f7f866

  • SHA1

    d948994130e626aea47ca1f26b7e77a2dd5871cf

  • SHA256

    b7de492efa8d6ff8aff98db157f16e27bb12e759f45c6a36e91ba7be70ada563

  • SHA512

    de046d0e44cbab57c05de79ca63ce14a13f2d01b6a7fbd03e86de19e2aa56dc0139884a76d326c5c60a1a6b960bff83ba0e13dea1e272635c6628a6736ec4a0d

  • SSDEEP

    12288:cNUhiHOR4LucvSFSrux88ndNtJXzLFzio:GUhiHOeE8rin3thLj

Score
9/10
ransomware

Malware Config

Signatures

  • Renames multiple (3745) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7de492efa8d6ff8aff98db157f16e27bb12e759f45c6a36e91ba7be70ada563.exe
    "C:\Users\Admin\AppData\Local\Temp\b7de492efa8d6ff8aff98db157f16e27bb12e759f45c6a36e91ba7be70ada563.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2704
    • C:\Users\Admin\AppData\Local\Temp\_AdobeARMHelper.exe
      "_AdobeARMHelper.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp
    Filesize

    78KB

    MD5

    4aa3868e3659bb592ac3d3ba63298360

    SHA1

    6865bcc01d90aca065c9b698cd947cf8cd9bdf84

    SHA256

    47f1a3e0b94ec9d0d6a2be7d64b24a7442395632b384ba9042d76ae42abb14a7

    SHA512

    6babd4bb10474e132827951cfdfe11f6f52f4b5ce374896ff11ad4cb9c5f4b35c3e6ec82233723a4da53dc9032d8315d76240a0dfdccae3f1a1e3ce84cbcf2ff

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_AdobeARMHelper.exe
    Filesize

    387KB

    MD5

    c18baf4d858b36dbf1e679c79c659a70

    SHA1

    f5638a26a57a9ef9dbfb0b1a324c13f2b548f308

    SHA256

    843dd18df8fd40e9e8ab2cecc52c03f2e95b0c2933162ba860d83e23c207b82c

    SHA512

    a46d780398f5066a90de5e0772a0a0f55f802dca023e8c90db271507aacec8f73a6f3a8cbd086031235e2037eab83975b68e52c17519efc4c6148b48f2ad2ee2

    Download Submit

  • \Windows\SysWOW64\Zombie.exe
    Filesize

    78KB

    MD5

    a2e9d76030ff69598f0066449d860df0

    SHA1

    076faa1130cc9ba2e33f3955351348b218a4716b

    SHA256

    d2a634e68db28eeef58a58c9918b5fb27281b53697d8b5e82fd7bad6c7487620

    SHA512

    6eb21a5327fef39bbb85329c968aeadb055397b3ada27f30a5f91cf0df93d29e0ba9e413ba4a817bdd4f95b96a506524942c98ad728a871860e5dd8da6c30b6b

    Download Submit