Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

5

b1b57b2c7c...a7.exe

windows7-x64

9

b1b57b2c7c...a7.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 02:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe

  • Size

    85KB

  • MD5

    dd9fba896eae7e9389c1d67e6e04be4e

  • SHA1

    fc277e744cb4ac2013a9406576a4a3a0c94b7ffb

  • SHA256

    b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7

  • SHA512

    9f1922c395b7a5d54b6ac2d5d332db9579f89e98077ff19ae87d45acef9d46514691af3fd89b7867031073397ca58693325d6215db0604e997fad6c6f2731842

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5eYAWcG:fnyiQSox5Z

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3482) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
    "C:\Users\Admin\AppData\Local\Temp\b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2348

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp
    Filesize

    86KB

    MD5

    c2f97c2f3dbc69ab397a8f1602ff9d7d

    SHA1

    48729568d18244fac1fdf1c404ef95890761ecfd

    SHA256

    b16628a3ba91f72239ff7a8e09456979369694f4c1039170b2a2999be4d56c69

    SHA512

    4cb1355e8869036649cbcf3aa8dfb36d080610a7a014e77e8525e5c918ddd9f2a845caba2e7bad84e81f8a6329d6babc9bdb818a911ce60226812b8ef6fdc109

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    95KB

    MD5

    55da089ce8e56fe12e7a7b37f2ef219c

    SHA1

    da03c024fe78c7a6dcc21742b2c50bb0fb428f5a

    SHA256

    31685c4299053107d992505fcca815bbc790058ecc5178f31c1976c02b057b90

    SHA512

    193fae3cfcebc4129029a10926a5369d0ad2b7046185cf4c18522b778cc1a2f90430cae7bd2686004ad1d6c273a99c7075d6c07ccde230631f843bbfe952df07

    Download Submit

  • memory/2348-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2348-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download