Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 14:38

General

  • Target

    d7ff8f49d4890c8cfa07db786f1c9cc0N.exe

  • Size

    86KB

  • MD5

    d7ff8f49d4890c8cfa07db786f1c9cc0

  • SHA1

    deadf04a260c033269b6db25a85f685804650299

  • SHA256

    1aaa253dacfedac31bea9e14438ecfa59c2bcbd273fc0cd793e30edc97ad0685

  • SHA512

    63fdb1d0ddc12b04526cdf5c6cc0f24530a18343d9d05a6d0a52cd0915e2e57891020afcb7142819c94cade7024c00bd8c707f26c4ee45d87e9e643722a6b2e4

  • SSDEEP

    1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8jsfEiKpqbr:enaypQSoTEi5

Score
9/10

Malware Config

Signatures

  • Renames multiple (4637) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7ff8f49d4890c8cfa07db786f1c9cc0N.exe
    "C:\Users\Admin\AppData\Local\Temp\d7ff8f49d4890c8cfa07db786f1c9cc0N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

    Filesize

    86KB

    MD5

    a59d727141b4fb4bd7c2948bc9cac329

    SHA1

    3a19c4e599db1297554bc318ceb77189a03b626f

    SHA256

    80dcb85a0a92cd787e357e943da0babb44478464794a6dc6a64302a1184221c3

    SHA512

    33508f5392982361d9f0c1b93e03f213f9909fa0a528b36711b2a3cd5ebc540d9f01329a23a8a040481201dea8317dceecb805f9855d11b50a0c11d87603681e

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    185KB

    MD5

    32303a7699467606d1e92e587aa1b3e3

    SHA1

    fc2462a41c18d5bb9d2242ad0296415681fa4d02

    SHA256

    ef3822695ba0b31e2a24a3a944d14db4095139b3e44caed10bc3dcabb7f56499

    SHA512

    4a2fd0e846da6215220cbf7c19437267cc05916168832426845ed15503ce1a4f843c193ec1f927095ff11869218de9e009fe0c1516ecc0e207352bb9b544afa9

  • memory/4716-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4716-1808-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB