Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2024, 17:03

General

  • Target

    04889a4f660af65a956cbab1c6a10010N.exe

  • Size

    69KB

  • MD5

    04889a4f660af65a956cbab1c6a10010

  • SHA1

    87e3eb38700370678d5fed2338284ab253ed879d

  • SHA256

    45ccda446707ca8cb2e7ce222c390e8f5bf78014961e5a94c34a8966133f2d82

  • SHA512

    6cb3d8062ecc1fd64e63a22f38a4790035b723355e60052e7bd8a43bba707afd3926634406ae559554ab0e8e2eea333399e4e2fe7a6840878b5be46ff0553b53

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx+:fnyiQSon

Score
9/10

Malware Config

Signatures

  • Renames multiple (3728) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04889a4f660af65a956cbab1c6a10010N.exe
    "C:\Users\Admin\AppData\Local\Temp\04889a4f660af65a956cbab1c6a10010N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

    Filesize

    69KB

    MD5

    afa589ec2eddfa350133b7878450d80c

    SHA1

    227e6f58983dd5c14bdeeaa05008bcdb42f4da36

    SHA256

    c12441b041a9584255d39ae681553867d40767914f0d5233d5f34d28592f6ec1

    SHA512

    cd73c190dcaae45902699dd26638a8996a7a4520df81e62676c743eb49e67d5c46e6d862f0d0b433244cc95f515ad0593aef7fa484a9e3275de0a4b9accae951

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    78KB

    MD5

    33793282999580a6a503ee270600d564

    SHA1

    249a1454315056ff7f7c0eb08926ccca2a5af0be

    SHA256

    6b61807fbffa2203112b742604fe122dbc171c1ee6fa20e853cc2ac246f07d26

    SHA512

    12e1d3d560c63beb04264c7d291904911b0325249db2a500c4c6554a4e13b3200f5bb4249700ebd0e2406bbc5c15a1233f124b6b33dc6fcaefc72b7abda0edf9

  • memory/1688-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1688-652-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB