Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

25/01/2025, 02:46

250125-c9q37atjcn 9

24/01/2025, 23:20

250124-3bhbhavpfp 9

Analysis

  • max time kernel
    361s
  • max time network
    370s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2025, 02:46

General

  • Target

    ENCRYPT.exe

  • Size

    64.5MB

  • MD5

    2c94c25286ed06ec9a5cacdb11013cf6

  • SHA1

    bd8a5e8d64bf79e0519c3bbba9ba40f203a15179

  • SHA256

    65731c5e9dd98ef1556457d9af51d37aae22658a45c1b7add4590f6aa3bd6a96

  • SHA512

    dc7bdfa7c9fdd1689697fcbe19bac822cf5c86ff0b2cff37465b6be5b535db59cf670d679075d1b0aee01776d8f5311a513f3b3c6f61bb40aab7b1da790175d0

  • SSDEEP

    1572864:cvIuV4GPk86ImGUDI4arnlGFO6VL3MegFfI1F:mhV4GWIqI4acOdtM

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ENCRYPT.exe
    "C:\Users\Admin\AppData\Local\Temp\ENCRYPT.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:352
    • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\ENCRYPT.exe
      C:\Users\Admin\AppData\Local\Temp\ENCRYPT.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Africa\Banjul

    Filesize

    148B

    MD5

    09a9397080948b96d97819d636775e33

    SHA1

    5cc9b028b5bd2222200e20091a18868ea62c4f18

    SHA256

    d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997

    SHA512

    2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Africa\Djibouti

    Filesize

    265B

    MD5

    86dcc322e421bc8bdd14925e9d61cd6c

    SHA1

    289d1fb5a419107bc1d23a84a9e06ad3f9ee8403

    SHA256

    c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968

    SHA512

    d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Africa\Kigali

    Filesize

    149B

    MD5

    b07064beada5be6289ed9485ecc9733d

    SHA1

    b0ff96d087e4c86adb55b851c0d3800dfbb05e9a

    SHA256

    444ed3a710414bc6bf43eb27e591da49d3be3db153449a6a0c9473f7e39fdbcb

    SHA512

    0ce1322f4a6f6568cdf61fc699eead4147015829650e90d791c223b45f3a23ead720ff41b4c8cc10ee915175e052d4740347a4454d23c18a3c57d30ded5a904c

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Africa\Lagos

    Filesize

    235B

    MD5

    8244c4cc8508425b6612fa24df71e603

    SHA1

    30ba925b4670235915dddfa1dd824dd9d7295eac

    SHA256

    cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846

    SHA512

    560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\America\Curacao

    Filesize

    246B

    MD5

    adf95d436701b9774205f9315ec6e4a4

    SHA1

    fcf8be5296496a5dd3a7a97ed331b0bb5c861450

    SHA256

    8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497

    SHA512

    f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\America\Panama

    Filesize

    182B

    MD5

    0972a9c4c28bf71eeab5f0bac573cdbc

    SHA1

    a94fbc2d567e41723f03629b6c9a864260108a17

    SHA256

    91ac80fe976931c490d058c8ce8b5d71ffa6d4961f6ca13ea9c153f0b0bccea0

    SHA512

    ece548f7d840a588523aacddc93891e0dd300390f79de063e60074e00a92ae33a8201642b841ff868387f1ac2188c485cce941d83c7a3617d27ac286dbcc0c17

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\America\Toronto

    Filesize

    3KB

    MD5

    8dabdbbb4e33dcb0683c8a2db78fedc4

    SHA1

    a6d038ecff7126ee19ebb08a40d157c9a79964cd

    SHA256

    a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f

    SHA512

    35bfd5182535f5257d7ee693eb6827751993915129d7f3cc276783926b1f4db7a00d8f0b44a95ac80c294a9cc1b84bda6418134c2a5c10ba6c89946bd8ef97a3

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Asia\Shanghai

    Filesize

    561B

    MD5

    09dd479d2f22832ce98c27c4db7ab97c

    SHA1

    79360e38e040eaa15b6e880296c1d1531f537b6f

    SHA256

    64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6

    SHA512

    f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Etc\UCT

    Filesize

    114B

    MD5

    38bb24ba4d742dd6f50c1cba29cd966a

    SHA1

    d0b8991654116e9395714102c41d858c1454b3bd

    SHA256

    8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2

    SHA512

    194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Europe\Isle_of_Man

    Filesize

    3KB

    MD5

    a40006ee580ef0a4b6a7b925fee2e11f

    SHA1

    1beba7108ea93c7111dabc9d7f4e4bfdea383992

    SHA256

    c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4

    SHA512

    316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Europe\Luxembourg

    Filesize

    2KB

    MD5

    355f0d3e2a3ee15ea78526f5eeb0cf7d

    SHA1

    d90f3247c4716c2e1068d5ad9c88ca2091bec4e8

    SHA256

    812f55aeb6e8cde9ddf4786e15eb4256b21e82cf5f5d28da1bad17d94570cac0

    SHA512

    96a5fa48a15167e55ffad5b0241c90caeb7f0433ad62dd43463a4c52c25c59f7357681cb586fc52e812e8173adc12cec9eff66d27d5f41e19d55f6c1fce12937

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Europe\Oslo

    Filesize

    2KB

    MD5

    7db6c3e5031eaf69e6d1e5583ab2e870

    SHA1

    918341ad71f9d3acd28997326e42d5b00fba41e0

    SHA256

    5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701

    SHA512

    688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Europe\Skopje

    Filesize

    1KB

    MD5

    6213fc0a706f93af6ff6a831fecbc095

    SHA1

    961a2223fd1573ab344930109fbd905336175c5f

    SHA256

    3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a

    SHA512

    8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Greenwich

    Filesize

    114B

    MD5

    9cd2aef183c064f630dfcf6018551374

    SHA1

    2a8483df5c2809f1dfe0c595102c474874338379

    SHA256

    6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d

    SHA512

    dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Pacific\Wallis

    Filesize

    152B

    MD5

    5bdd7374e21e3df324a5b3d178179715

    SHA1

    244ed7d52bc39d915e1f860727ecfe3f4b1ae121

    SHA256

    53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7

    SHA512

    9c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\Pacific\Yap

    Filesize

    172B

    MD5

    ec972f59902432836f93737f75c5116f

    SHA1

    331542d6faf6ab15ffd364d57fbaa62629b52b94

    SHA256

    9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0

    SHA512

    e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d

  • C:\Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\pytz\zoneinfo\US\Mountain

    Filesize

    2KB

    MD5

    648f67a7744849f2ca07f4d5871e9021

    SHA1

    faa7d6cf4178d032d8ba8a4d77eac0fd47f8a718

    SHA256

    32e819c00a43b3c348f539d700d425504f20b8d068c16418d26fa9b693e775c9

    SHA512

    3dab6d6a04a4856cba78ef499f1a436f1f71b1dea494ee098b76c1702531108ae0a1d7b6de05e9d9315027624b790e084d69b25507738099f6026cd2a9559f31

  • \Users\Admin\AppData\Local\Temp\onefile_352_133822468706274000\python311.dll

    Filesize

    5.5MB

    MD5

    65e381a0b1bc05f71c139b0c7a5b8eb2

    SHA1

    7c4a3adf21ebcee5405288fc81fc4be75019d472

    SHA256

    53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a

    SHA512

    4db465ef927dfb019ab6faec3a3538b0c3a8693ea3c2148fd16163bf31c03c899dfdf350c31457edf64e671e3cc3e46851f32f0f84b267535bebc4768ef53d39