Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
361s -
max time network
370s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
DECRYPT.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
DECRYPT.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
ENCRYPT.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ENCRYPT.exe
Resource
win10v2004-20241007-en
General
-
Target
ENCRYPT.exe
-
Size
64.5MB
-
MD5
2c94c25286ed06ec9a5cacdb11013cf6
-
SHA1
bd8a5e8d64bf79e0519c3bbba9ba40f203a15179
-
SHA256
65731c5e9dd98ef1556457d9af51d37aae22658a45c1b7add4590f6aa3bd6a96
-
SHA512
dc7bdfa7c9fdd1689697fcbe19bac822cf5c86ff0b2cff37465b6be5b535db59cf670d679075d1b0aee01776d8f5311a513f3b3c6f61bb40aab7b1da790175d0
-
SSDEEP
1572864:cvIuV4GPk86ImGUDI4arnlGFO6VL3MegFfI1F:mhV4GWIqI4acOdtM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1848 ENCRYPT.exe -
Loads dropped DLL 2 IoCs
pid Process 352 ENCRYPT.exe 1848 ENCRYPT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 352 wrote to memory of 1848 352 ENCRYPT.exe 30 PID 352 wrote to memory of 1848 352 ENCRYPT.exe 30 PID 352 wrote to memory of 1848 352 ENCRYPT.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ENCRYPT.exe"C:\Users\Admin\AppData\Local\Temp\ENCRYPT.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\ENCRYPT.exeC:\Users\Admin\AppData\Local\Temp\ENCRYPT.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD509a9397080948b96d97819d636775e33
SHA15cc9b028b5bd2222200e20091a18868ea62c4f18
SHA256d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997
SHA5122eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799
-
Filesize
265B
MD586dcc322e421bc8bdd14925e9d61cd6c
SHA1289d1fb5a419107bc1d23a84a9e06ad3f9ee8403
SHA256c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968
SHA512d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b
-
Filesize
149B
MD5b07064beada5be6289ed9485ecc9733d
SHA1b0ff96d087e4c86adb55b851c0d3800dfbb05e9a
SHA256444ed3a710414bc6bf43eb27e591da49d3be3db153449a6a0c9473f7e39fdbcb
SHA5120ce1322f4a6f6568cdf61fc699eead4147015829650e90d791c223b45f3a23ead720ff41b4c8cc10ee915175e052d4740347a4454d23c18a3c57d30ded5a904c
-
Filesize
235B
MD58244c4cc8508425b6612fa24df71e603
SHA130ba925b4670235915dddfa1dd824dd9d7295eac
SHA256cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846
SHA512560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c
-
Filesize
246B
MD5adf95d436701b9774205f9315ec6e4a4
SHA1fcf8be5296496a5dd3a7a97ed331b0bb5c861450
SHA2568491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497
SHA512f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348
-
Filesize
182B
MD50972a9c4c28bf71eeab5f0bac573cdbc
SHA1a94fbc2d567e41723f03629b6c9a864260108a17
SHA25691ac80fe976931c490d058c8ce8b5d71ffa6d4961f6ca13ea9c153f0b0bccea0
SHA512ece548f7d840a588523aacddc93891e0dd300390f79de063e60074e00a92ae33a8201642b841ff868387f1ac2188c485cce941d83c7a3617d27ac286dbcc0c17
-
Filesize
3KB
MD58dabdbbb4e33dcb0683c8a2db78fedc4
SHA1a6d038ecff7126ee19ebb08a40d157c9a79964cd
SHA256a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f
SHA51235bfd5182535f5257d7ee693eb6827751993915129d7f3cc276783926b1f4db7a00d8f0b44a95ac80c294a9cc1b84bda6418134c2a5c10ba6c89946bd8ef97a3
-
Filesize
561B
MD509dd479d2f22832ce98c27c4db7ab97c
SHA179360e38e040eaa15b6e880296c1d1531f537b6f
SHA25664ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6
SHA512f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200
-
Filesize
114B
MD538bb24ba4d742dd6f50c1cba29cd966a
SHA1d0b8991654116e9395714102c41d858c1454b3bd
SHA2568b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2
SHA512194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac
-
Filesize
3KB
MD5a40006ee580ef0a4b6a7b925fee2e11f
SHA11beba7108ea93c7111dabc9d7f4e4bfdea383992
SHA256c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4
SHA512316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e
-
Filesize
2KB
MD5355f0d3e2a3ee15ea78526f5eeb0cf7d
SHA1d90f3247c4716c2e1068d5ad9c88ca2091bec4e8
SHA256812f55aeb6e8cde9ddf4786e15eb4256b21e82cf5f5d28da1bad17d94570cac0
SHA51296a5fa48a15167e55ffad5b0241c90caeb7f0433ad62dd43463a4c52c25c59f7357681cb586fc52e812e8173adc12cec9eff66d27d5f41e19d55f6c1fce12937
-
Filesize
2KB
MD57db6c3e5031eaf69e6d1e5583ab2e870
SHA1918341ad71f9d3acd28997326e42d5b00fba41e0
SHA2565ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701
SHA512688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe
-
Filesize
1KB
MD56213fc0a706f93af6ff6a831fecbc095
SHA1961a2223fd1573ab344930109fbd905336175c5f
SHA2563a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a
SHA5128149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327
-
Filesize
114B
MD59cd2aef183c064f630dfcf6018551374
SHA12a8483df5c2809f1dfe0c595102c474874338379
SHA2566d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d
SHA512dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92
-
Filesize
152B
MD55bdd7374e21e3df324a5b3d178179715
SHA1244ed7d52bc39d915e1f860727ecfe3f4b1ae121
SHA25653268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7
SHA5129c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383
-
Filesize
172B
MD5ec972f59902432836f93737f75c5116f
SHA1331542d6faf6ab15ffd364d57fbaa62629b52b94
SHA2569c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0
SHA512e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d
-
Filesize
2KB
MD5648f67a7744849f2ca07f4d5871e9021
SHA1faa7d6cf4178d032d8ba8a4d77eac0fd47f8a718
SHA25632e819c00a43b3c348f539d700d425504f20b8d068c16418d26fa9b693e775c9
SHA5123dab6d6a04a4856cba78ef499f1a436f1f71b1dea494ee098b76c1702531108ae0a1d7b6de05e9d9315027624b790e084d69b25507738099f6026cd2a9559f31
-
Filesize
5.5MB
MD565e381a0b1bc05f71c139b0c7a5b8eb2
SHA17c4a3adf21ebcee5405288fc81fc4be75019d472
SHA25653a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a
SHA5124db465ef927dfb019ab6faec3a3538b0c3a8693ea3c2148fd16163bf31c03c899dfdf350c31457edf64e671e3cc3e46851f32f0f84b267535bebc4768ef53d39