Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2022, 00:13

General

  • Target

    a0b9699e7ae965678024fde6e02946cbb6115a58528f2d3739ff91cafebc83c7.exe

  • Size

    3KB

  • MD5

    794922cdb2b13255a76a51aa2ebb84ed

  • SHA1

    243b8d205f32bbb06f53734718f6acdad4d9d261

  • SHA256

    a0b9699e7ae965678024fde6e02946cbb6115a58528f2d3739ff91cafebc83c7

  • SHA512

    429e10781eb0e39f7153612e54c65b0ebf966ed31054eadb0ca20c5dbffeda7128d8bda9ea43e90565d340ac0a99f71d434803b18f668982a5bb98e2dbecc143

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0b9699e7ae965678024fde6e02946cbb6115a58528f2d3739ff91cafebc83c7.exe
    "C:\Users\Admin\AppData\Local\Temp\a0b9699e7ae965678024fde6e02946cbb6115a58528f2d3739ff91cafebc83c7.exe"
    1⤵
    • Checks computer location settings
    PID:1964

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1964-132-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB

  • memory/1964-133-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB