Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 14:28

General

  • Target

    0122ef19391ba8a15732c1abc9ade560N.exe

  • Size

    45KB

  • MD5

    0122ef19391ba8a15732c1abc9ade560

  • SHA1

    57f4a60a969611aec3c4318d67bd98277f4f0275

  • SHA256

    9c2d839404b9ff317fd86bb74aed5bf63b2038e7b9a6cbd2e5c86d86bfd37323

  • SHA512

    0a9381444b775eba3d10b236c30eb3cad7b6502e5fbbe94c969e6d8808eaeddf14f9db87798436c7cb2ec1dffd65eff95251304f5395825af1966e7ff84b2eca

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFnz:CTWn1++PJHJXA/OsIZfzc3/Q8+G

Score
9/10

Malware Config

Signatures

  • Renames multiple (5060) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0122ef19391ba8a15732c1abc9ade560N.exe
    "C:\Users\Admin\AppData\Local\Temp\0122ef19391ba8a15732c1abc9ade560N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    85d9482d6a915faa973dcc5155b4e793

    SHA1

    adcd4ae28de68d25919e4d2cf3ed446375e3d258

    SHA256

    053a67de460d8e520231349b4b526d0ce81badc3da941135bffd04c90cb1bd3e

    SHA512

    29f8188c380e0e3c513a13681702f6bdf4351bc86f709bf5569e7a4253a821ce4e75d75de7386c2332f716c386f9f21e20f385367e9935bc709c62930f35a266

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    144KB

    MD5

    4ea6fd3b853cf8b51fb547784ee62774

    SHA1

    dbd7727bbd5f95466f8df119b1a235e35e5a3601

    SHA256

    50c78adef100f9fab3f50638f8ab6b9f9cb4c653f1dd60707adbaca5abb76d69

    SHA512

    c6ee8187b8e5811fe7b7ff47c63e1dec5f97da4942e134968b729d3e530cef78c9657dfdb8aca9b69d22bf14f60eeada7fe3483788363bb0eefc20952787ade7

  • memory/4196-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/4196-1078-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB