Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/08/2024, 11:42 UTC

240808-nt7xjswhle 10

27/07/2024, 01:20 UTC

240727-bp25aazhmf 10

Analysis

  • max time kernel
    77s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 01:20 UTC

General

  • Target

    3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe

  • Size

    326KB

  • MD5

    2639ec5825ff4ff231b5c50cd50b9514

  • SHA1

    9e13e135171f42bd466f26242b320763bbfcfba2

  • SHA256

    3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545

  • SHA512

    207f3fa4577326df71c21a5b871b2e4778c6486ca4f289495b8b391314b2c9fc507c883615870c3cd8c1fe832918f06e375ce16d04f213048312e7d70a8d5dda

  • SSDEEP

    6144:PXqpsIPCYYNUBEP+abW67Dz4HFgnPOAzu0bD7P9YJJE:PqaIPbyUBWa5CPO0bPP9SJE

Score
10/10

Malware Config

Signatures

  • PLAY Ransomware, PlayCrypt

    Ransomware family first seen in mid 2022.

  • Renames multiple (3466) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops desktop.ini file(s) 12 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe
    "C:\Users\Admin\AppData\Local\Temp\3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:1760
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
      PID:2552

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini

      Filesize

      1KB

      MD5

      567f35c849b7a7a0a69a7f3cf61ac504

      SHA1

      c9b4ac91f57de9afb6b9699fd45adcf145d2c3b7

      SHA256

      7335d3e87a952bbb0e96e81abbdfa3c967713cc4a14e54f4d0881ce6b3e0cdbe

      SHA512

      56358180bb625f9edc9b0c9c667fac94fdeb2293493b9d0c59e41a110169ba9f50951b0041380036b7fce6acfc51ab66890cafd205220f48395bc3d0222573bf

    • memory/1760-0-0x0000000000290000-0x00000000002BC000-memory.dmp

      Filesize

      176KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.