Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

7

1e66d7e225...0N.exe

windows7-x64

9

1e66d7e225...0N.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e66d7e2250d925b6d64ecd99cf16ee0N.exe

  • Size

    137KB

  • Sample

    240802-3wqtdawamm

  • MD5

    1e66d7e2250d925b6d64ecd99cf16ee0

  • SHA1

    b11c33334183f13d73a8194a9c3ffa5e7e08e7b8

  • SHA256

    d5852c8bdc2f7dfd5475eb6f929a44903f490d57f34ba20bc1509cb395793d98

  • SHA512

    398d44bd150e621c38b60de0ffee55b77901926419895dfb7f405cbd658b2f1a06f6247699d7edeb5f8576e535f5d62e9fe925d34f0ddb51a95bb122c3fef51c

  • SSDEEP

    1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8IZW17ZyqaFAxTWH1++PJHJXA/OsIZfm:enaypQSo7ZW/naypQSo7ZWb

Score
9/10
discoveryransomwareupx

Malware Config

Targets

    • Target

      1e66d7e2250d925b6d64ecd99cf16ee0N.exe

    • Size

      137KB

    • MD5

      1e66d7e2250d925b6d64ecd99cf16ee0

    • SHA1

      b11c33334183f13d73a8194a9c3ffa5e7e08e7b8

    • SHA256

      d5852c8bdc2f7dfd5475eb6f929a44903f490d57f34ba20bc1509cb395793d98

    • SHA512

      398d44bd150e621c38b60de0ffee55b77901926419895dfb7f405cbd658b2f1a06f6247699d7edeb5f8576e535f5d62e9fe925d34f0ddb51a95bb122c3fef51c

    • SSDEEP

      1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8IZW17ZyqaFAxTWH1++PJHJXA/OsIZfm:enaypQSo7ZW/naypQSo7ZWb

    Score
    9/10
    discoveryransomwareupx

    • Renames multiple (346) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks