Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 23:03

General

  • Target

    26341df8a0256d8d123a3a8679946360N.exe

  • Size

    78KB

  • MD5

    26341df8a0256d8d123a3a8679946360

  • SHA1

    fbbb33112a4b05bcaba67811a0a345468568b1ad

  • SHA256

    e3b1f8ee7a64e38f1f0ab4d6c5968be4560cb79d424e026fdb6ba4592c147ca2

  • SHA512

    f3ec38e4a6b4b3598d5cb229c61bed2b3a08ba34829bdc778592ea20d392d6c58ba2d636d7f922a40cadb32e3c3c25872f9b965e9eb5850c372faa14c0fe1d10

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxSm6yB0kwNBQ0nQi:fnyiQSoCvi

Score
9/10

Malware Config

Signatures

  • Renames multiple (3103) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26341df8a0256d8d123a3a8679946360N.exe
    "C:\Users\Admin\AppData\Local\Temp\26341df8a0256d8d123a3a8679946360N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    78KB

    MD5

    c1e818e925564b0680898eecf0b09f4c

    SHA1

    aa5fb31db587c0b08aef0a6edaab85458e1a0703

    SHA256

    117953e6042632edf834d13b2d6d5d9fe028c3416351a1d97f20cf8a73fb66a8

    SHA512

    e6629c9e9d4b0e482782e6d3b26b43250ad52262d07add8eee17d60330d34a2e58a4c7ce1010f74cb9f1d526411c932bc5a7d7b26810d03fe8e1dab7883a2ed3

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    87KB

    MD5

    b11eab7aeb6654f44538671e9cabd6d4

    SHA1

    6160659f305f0ce9ad6d3ef8cf66e654e19d543f

    SHA256

    7c545dbd7a3c8921906be782868e64c6d0e8b5113500479bbca86ebb80856bbf

    SHA512

    60b26240d5cc034a85de6eacdd481396b825e6b3dac445bf7b3e9d428f9b59a474a99294f0cbae875f07ea73046070d550234beffb996d52137761a98b67b542

  • memory/2640-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2640-642-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB