Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 14:28

General

  • Target

    0122ef19391ba8a15732c1abc9ade560N.exe

  • Size

    45KB

  • MD5

    0122ef19391ba8a15732c1abc9ade560

  • SHA1

    57f4a60a969611aec3c4318d67bd98277f4f0275

  • SHA256

    9c2d839404b9ff317fd86bb74aed5bf63b2038e7b9a6cbd2e5c86d86bfd37323

  • SHA512

    0a9381444b775eba3d10b236c30eb3cad7b6502e5fbbe94c969e6d8808eaeddf14f9db87798436c7cb2ec1dffd65eff95251304f5395825af1966e7ff84b2eca

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFnz:CTWn1++PJHJXA/OsIZfzc3/Q8+G

Score
9/10

Malware Config

Signatures

  • Renames multiple (3749) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0122ef19391ba8a15732c1abc9ade560N.exe
    "C:\Users\Admin\AppData\Local\Temp\0122ef19391ba8a15732c1abc9ade560N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    f05a9b2236d406951ac5da92fce39d5e

    SHA1

    91ab916d9c456e91bfb402405f9ec8a671840d69

    SHA256

    18c05560cc48de8589623487f7bce6310f51cb76dcc29fc4268f511b2ddfe351

    SHA512

    221a22385bc387eaa829a18be19aa48127ba5fb969cb1c105b76e8e44ca5ab2b1cce33a66fef2f26dce45bf6cd09499ef4e4169bb9f302090ceb0ce446bf7a2c

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    54KB

    MD5

    1ae67c20492c73486c3c0e8cc81ee4f0

    SHA1

    0de3e98dc554070708cd21e42493eab424020589

    SHA256

    62fd91aeaedd54340253d9ffd150eaee4d5a87ea5f297d4585ca3d2efe50037c

    SHA512

    2f1a589552232c559fbf1912d1c053a63a17a2ba5872a7a6d93efb3ca99773067c90f5499d295dcd337059e6bda95a9226c66cc09631b2f6258be4ef87ee7c36

  • memory/2984-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2984-76-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB