Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 00:49

General

  • Target

    2151f0582f10e784d21cf906a9a82980N.exe

  • Size

    68KB

  • MD5

    2151f0582f10e784d21cf906a9a82980

  • SHA1

    736d787d9b33335087a9f5afc228c821a9da248c

  • SHA256

    5e784e243a70f6b490c901366fa5ea5d4d53e8ef842cb2f3b8fdc237ea2d8f1e

  • SHA512

    4562be79611bec65291fa0b3a817c5fe8fae8b16a5568694fa5a617f3a4a5e22babd9e32cf0777bd19c1bb79290218f1011c538def27b067a36381f6579b689d

  • SSDEEP

    1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fC/:enaypQSosk0

Score
9/10

Malware Config

Signatures

  • Renames multiple (3115) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2151f0582f10e784d21cf906a9a82980N.exe
    "C:\Users\Admin\AppData\Local\Temp\2151f0582f10e784d21cf906a9a82980N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    68KB

    MD5

    40e4c5324f5cbb065b08519f533f529b

    SHA1

    132eadd53cb6557d888141f1e0f8a5f602db0222

    SHA256

    66aa32e30b22ab268c54a52aa69232d52a6f557b03243b2843fdda278710e6f8

    SHA512

    1ae4793de2a25f7197fc871c1ac2ad5ae35825357d3b971a2da774ebeb0c822a6f4cdeab6cd53d682e7a84b7ae383916a1c2b9cd7505cfb14f81882e098701be

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    77KB

    MD5

    19bfb791ee6142a8c8ec0bce1e717a2a

    SHA1

    344cc337cafcf4e04865757f19bdd7a96d5250e2

    SHA256

    bf4c81277905ce9ae22f7cf3845cc1f0f26e01955a8e3e89b5051e978d71754b

    SHA512

    01446d82d7db6b8ae9198fe602752e136e0fb5eb071abce7955f0ce874a3c02ab9c5b1d80cc5d94be559a54a6f9f08939e27cfbecfc29619c04f2be2d98ff8d2

  • memory/388-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/388-650-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB