Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 14:05

General

  • Target

    0b2955689a4f5363aab5769351ef757b1a87ee11de89130c1c8f4b538c725995.exe

  • Size

    357KB

  • MD5

    f6aa22f22ac2e9d1bda7209f29ae4705

  • SHA1

    86f9ee507587a0f022fbf19cc237eec4bcfa74b2

  • SHA256

    0b2955689a4f5363aab5769351ef757b1a87ee11de89130c1c8f4b538c725995

  • SHA512

    1358c052e641751afbe08a9235c44bbd9c8df7eee27bfc15ad6946584f6a982d17362d83da997ca4ba7c973cf698ce53a4b4b16c63d6324ac41110557c90ae9a

  • SSDEEP

    6144:O8Uv494I2tkHZzrL9iw2VKDq/7Kl4CJvmBN5g20LIst+P6H004uzgq39TWa:xUv494IRZfg7KjJvmBmZHJgW9

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b2955689a4f5363aab5769351ef757b1a87ee11de89130c1c8f4b538c725995.exe
    "C:\Users\Admin\AppData\Local\Temp\0b2955689a4f5363aab5769351ef757b1a87ee11de89130c1c8f4b538c725995.exe"
    1⤵
    • Checks computer location settings
    PID:2620

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2620-133-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/2620-134-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB