Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

7

ad8e2a1ea7...0N.exe

windows7-x64

9

ad8e2a1ea7...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 21:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ad8e2a1ea79ba1693f935bd55903e010N.exe

  • Size

    156KB

  • MD5

    ad8e2a1ea79ba1693f935bd55903e010

  • SHA1

    9b3ded06a76147ea742ed3ba5466422235c1022d

  • SHA256

    d18453c10bf3c7116375d1fe26bf460e7d3b00660630d0f61a9fdb857e5637b5

  • SHA512

    edd3d1acc2824c636dfe39f63d7e1de861bf866ddd297a413687a1477014b65112c8f5d5cfbe211d599cbc86bcb447464aaef8538408e7a8caa65030ad1f0502

  • SSDEEP

    3072:fny1IKX5vcM3ZpCbYjBQqOPzrjz/Lwn5NWRDv/f6ETy7oY8:KjAsjSlTwn5ODVy7oY8

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (2740) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad8e2a1ea79ba1693f935bd55903e010N.exe
    "C:\Users\Admin\AppData\Local\Temp\ad8e2a1ea79ba1693f935bd55903e010N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp
    Filesize

    156KB

    MD5

    e626494cc2288de57508ab094fe421be

    SHA1

    ef0c36a057c0a5c782c112c5bbaf99a6e2691667

    SHA256

    226f7d02ec75124861b7ab0a8b2096d1c4a584596ec92c8494ea1fbeab3e6836

    SHA512

    3d55b75894de7619d60b19d2c9aefacb32e84fea78b7c1ff8405f7e1d1505525f51660a49825468fbf9473782bd0c56de14da0221b534ec1fb19597bb2bb647b

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    165KB

    MD5

    bb95833b6e0781368a9dda7f415da3f3

    SHA1

    bed302823714e164d2c6323ae39d5c908ac43643

    SHA256

    698b55e25fa112c00965721506f6348e13a4b9d3b89b61906bc2ea4abc8ea791

    SHA512

    b5c75139f93aabf0ac46ccf32b7fa98a109b903a14347dd4be1919013b8aff160672f9f1c5b2e868fbe145c2ec67df40181c81a06ce9666e261319ce2f2811f7

    Download Submit

  • memory/2240-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2240-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download