Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 09:19

General

  • Target

    8fea1b165c0ab995449e8a7d4beda370N.exe

  • Size

    40KB

  • MD5

    8fea1b165c0ab995449e8a7d4beda370

  • SHA1

    aa28d443c37369ed9db9183df03a4e38f00cae26

  • SHA256

    d27f8bd2e292bd360e2d49b945e61faf07f9c761ffd3abf745df9714308b5991

  • SHA512

    525a24f5eaaaacd7abd3a755db28ce1363d222f7da045ffa2b7a75263666ddb9142c9c25490f1f8e7de7ac7b459cf608fdbed9081f9ac3592b3985e7e81dc450

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyA:V7Zf/FAxTWoJJZENTNyA

Score
9/10

Malware Config

Signatures

  • Renames multiple (4349) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8fea1b165c0ab995449e8a7d4beda370N.exe
    "C:\Users\Admin\AppData\Local\Temp\8fea1b165c0ab995449e8a7d4beda370N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini.tmp

    Filesize

    40KB

    MD5

    f13f89b8ef2b7138fcd77cb1992f6c16

    SHA1

    5585cbbe2a904078f8fd629c1fe97fcaf72cebe7

    SHA256

    0668f9977b251d09c8337aaa09468b3d4061223dd2c6b806ba0df3dd138cb56b

    SHA512

    8c9360ad8b131f18354eddf1b697d3858d07575eccdbb1bbbc102d06e306aebd25ca003de6215157a82fa82592fe76d2ef9a07b16c7295b98c22075b6b351a6e

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    139KB

    MD5

    4ac29945dadcda1fd796ebde23ee883c

    SHA1

    c49d41539432f22fe7d15b7d945f4b647b784611

    SHA256

    c63abd5edb4b2db981a6aeaede058bc8663ee0af022333857bc27e2d22270ef9

    SHA512

    00764e769bb9adb0feac0e308d156b12e44e6097d887082fe873521e4762cf28e05b369cf8c907ef3a295e76ccbe0e0eef477f1104062efb8a8cc6fba1e4c8c7

  • memory/4484-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4484-1784-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB