Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 05:15

General

  • Target

    d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe

  • Size

    79KB

  • MD5

    50656f12d52e27fdf8d0669635b9db8b

  • SHA1

    5b4b3e3f0cc471b36de969f942d8dfb5305ade1d

  • SHA256

    d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c

  • SHA512

    510c19203652956bcd4132b3a6fb3bf095c8f584ddad298929b9852fbd0808f075571847bd62b10a8f9da6879bdb942ef3ac9d6466655d2d44f00e2a934582e6

  • SSDEEP

    768:tOKkRrbAeAvnLPu5BEAUMkCf9xszmJSwO8I3eUZjwyDOJJb+QhyU9o:yRrbAeAvn7uyMd6wO8wPw+JL

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe
    "C:\Users\Admin\AppData\Local\Temp\d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe"
    1⤵
    • Checks computer location settings
    PID:3800

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3800-132-0x0000000000760000-0x0000000000777000-memory.dmp

    Filesize

    92KB

  • memory/3800-133-0x0000000000760000-0x0000000000777000-memory.dmp

    Filesize

    92KB