Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

5

7ace5670b0...31.exe

windows7-x64

9

7ace5670b0...31.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    60s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 19:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe

  • Size

    607KB

  • MD5

    31bc95a2577acda7a463b0727cc8e25b

  • SHA1

    2169ea61f0f7f3e07ef1c249184caae15149b996

  • SHA256

    7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31

  • SHA512

    8ec609f65ec901101619d8171bd10c56a2fad3fc22c459288eef4442340e8414b6ec86e2ff784d1c3c6f3f8d31e21718219567921518423e54611e5c7f1fcf23

  • SSDEEP

    6144:KQSolf5uKhbSnHXBMV5jdCBjtsD52dmdLqff86+jVvaYMLOen9Bp1xf2ODuYMyRE:KQtlUVRMstsD5pAfujVvaYML59RIgq

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (555) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe
    "C:\Users\Admin\AppData\Local\Temp\7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:2376
    • C:\Users\Admin\AppData\Local\Temp\_MpCmdRun.exe
      "_MpCmdRun.exe"
      2⤵
      • Executes dropped EXE
      PID:2312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp
    Filesize

    54KB

    MD5

    20bf194e46d02c52a0dcaf8fd22fabc9

    SHA1

    076d40559cf01a30ace42c8342333e8845a0478a

    SHA256

    e10de9bcdf950122155fae564b817cdbd8d34fc3f682c2b62d1fcd4b1708510e

    SHA512

    93723ac392ee3fdbb10b3f189182351ce299157812ac9a8f56a305ff8dc1e0204335e0d2670079fc67c05d3337095ba4bc0bbf387d329a99b43c73f58152f867

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MpCmdRun.exe
    Filesize

    553KB

    MD5

    d20b034be63c99803fb9b659d5e08c4f

    SHA1

    cc6846f52e59a0c84a16fcadca34a8996630a0d2

    SHA256

    ac9142ef4843eed75a010d6d31386f288757e9bffab9072eeb20c4a16ab5a26b

    SHA512

    fdf53323a320e39b98c0a0b327437e96dd1d405025b93d8909cd3821dbdec0ef9bc1bec09a6471d31b3f7af07ce587aa450c7bc2da56ce7abfaa6a607bc2b168

    Download Submit

  • \Windows\SysWOW64\Zombie.exe
    Filesize

    54KB

    MD5

    f192d2312c7c07b14716990f9bfe659c

    SHA1

    dc9c31f8cce47f85499c5e7612240cf6531fd8e7

    SHA256

    0b7902476fe3271ace16be1d5f157d15c596b1dc4fb770ef1616d89a59576624

    SHA512

    dc8141a04133946e7000e7e3d495bab9123af7ef543182d955f716494c12c5bda9c756e655e8767281aa4d7194e4879dbcfbb487cc1b9d4a128938e6aa28a7a0

    Download Submit

  • memory/2104-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2104-13-0x00000000003B0000-0x00000000003BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2104-12-0x00000000003B0000-0x00000000003BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2104-25-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2376-14-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download