Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
87s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
01/01/2025, 03:31
General
-
Target
syphra (5).zip
-
Size
5.4MB
-
MD5
c743458ebed7718a4e3bf573013e4598
-
SHA1
455887a78870569b0b9d09aa3017164e56d86929
-
SHA256
35b3393164c065c7108e0f1af636da335c26acd71234677d8ed796425d297fd7
-
SHA512
82406adcd46d0001db656262ecdb214550185d61f557d0baa91e013afd2c88bed5f405ae06c40f7447f7a8628d0c473e21a3e48c31a3e91098d3e1ecb0f64127
-
SSDEEP
98304:EkkNfLQQY+lmp0BbW+OwzFeBCnGOChTcU5AQ6YYJNiGwPW6uBnJkCd6lqX/Xw2M+:E9LQl+EMkBCvCpl5+XiZe6u8CdW4g4d
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\syphra (5).zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\fff\Syphra.exe"C:\Users\Admin\Desktop\fff\Syphra.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\fff\key.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Desktop\fff\Syphra.exe"C:\Users\Admin\Desktop\fff\Syphra.exe"1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55823a29cae5e65131a0f89538e43e7b8
SHA1515f01dd5be34010baa391d699f313ee1def55ba
SHA25670d951b26ba9eaef60feb2baf02a02664fc68a795dc0025a4d18cb6f8814daa2
SHA5121068554e4eebbc867b706d9a74665c91a1b751a95b0a7065f503b69577a00849d635db7ad0ac98f43caf20035203f71ac5f535261eba16010a5df2949ff491af
-
Filesize
1.6MB
MD546630830806724602b9dd8111c6f1d98
SHA15324edf8bf5b7c94cac2d869d31641b7557b6701
SHA256cd45f87c82da868ecd184676d9bf1e8b4cbb5216052920e34ebb04d0591db35b
SHA512e8b73474dada6167d5428a872031c566131d0a1187be846a455644decd442e610ea10e19b7484395b4791006c9c64988e7ab5cf0e8c0b01d69509c64b9c4b462
-
Filesize
17B
MD58b13b91cba59408211c53ff554a4b681
SHA1c2bb5a04bb1b68b1df6d6f726273c08ab89b30c0
SHA256b1375aff61d34fd8a3a2c7318f9d8cf9722e6a7eb95a75cd8e8d6c701ff6b9c6
SHA5124e7c38ee9358793603bdf43cc0fd14904a18ff08800f3f30e2e3262fe884f276bb43ea2cd8113ff603b3655f39de132380027233f1e65a19125d2c2645cd8e12
-
Filesize
141B
MD566bdc0c2fd43029d4f33b2833fb117aa
SHA1ff3d2d4d5f431b124e37c08dd19b18994e6a05b7
SHA256aed2dd9a0486d116e090a715385775e8240f68e2b48b905cc82a43836c7415aa
SHA5125a202d42e97135f6f75a87524e1ab46469961b8c2ba784a35e333cebf2e7f6eafa1bd18663e2928342e51e4d986be32e21155d8a7af93340f6d20660d44598b5
-
Filesize
136KB
-
Filesize
712KB
-
Filesize
1.3MB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
104KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.6MB
-
Filesize
8KB
-
Filesize
80KB