Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2024, 10:46

General

  • Target

    Ransomware.exe

  • Size

    878KB

  • MD5

    7f29dfc164eff93e11d230a621901145

  • SHA1

    1d9f10518b95315cdc648ba415335ab510804f3e

  • SHA256

    e75e6de7b10900b328ff8f80504a191874ee8c45ca6df94c7ceb59e62cbb15ca

  • SHA512

    0deeca68a6b0449daf33f86c9d0be54bf6c681583618f717cd9cb949a6d9b0a6bb339184df2fc9f21c6f36a8ac9f0e0a80f7b9416b985b1be6ef6149e1978678

  • SSDEEP

    12288:DCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga4TibtQ:DCdxte/80jYLT3U1jfsWaAibtQ

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:740
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
      PID:4876
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
        PID:4956

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads