Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 18:39

General

  • Target

    0aca521870c5c3f31a5c96a6bb17a06b77afaf056510849532bba32fa5610328.exe

  • Size

    380KB

  • MD5

    c9faeba25c41b5ea2fb64d512b4d1fd0

  • SHA1

    b960fa602d750d4038e32436ce4c88706c6a0692

  • SHA256

    0aca521870c5c3f31a5c96a6bb17a06b77afaf056510849532bba32fa5610328

  • SHA512

    bf6074fbbe0ca1fbcbb05277dc30a51bfc568d8fb16ba22ee93ab03efef5f5490099a372a69d22a1eda75e4531fe576d1764f2c97451d645ae539fd003e6bd42

  • SSDEEP

    6144:QcLlfb0KVV30u9/6qqjJ+mXguEGeZTIqVOM61TuxL8XhWRRcox8YQ/ECgT2dtG:Qchfb0KVVz/QA2QTH6luadtG

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0aca521870c5c3f31a5c96a6bb17a06b77afaf056510849532bba32fa5610328.exe
    "C:\Users\Admin\AppData\Local\Temp\0aca521870c5c3f31a5c96a6bb17a06b77afaf056510849532bba32fa5610328.exe"
    1⤵
    • Drops startup file
    • Drops file in Windows directory
    PID:3436

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3436-132-0x0000000002F00000-0x0000000002F2F000-memory.dmp

    Filesize

    188KB