Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 23:55

General

  • Target

    8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe

  • Size

    342KB

  • MD5

    d85a2e899c60a19e8170ed40d330ccbe

  • SHA1

    9a9d011523d8a8a291e1e0a1ee0eb6c5459a081a

  • SHA256

    ab4930d3748a2e5b849b06d70eddc8844de00f92bd0a1e6a212e38bfb82e5d6f

  • SHA512

    a5cb7f0c0a849c32b25f48406623012443260f19dac2fca3df055ea5f256ba7d3f46b81e9f0e275622b2a912970de4f83924000d9aabab573269524c7d145a08

  • SSDEEP

    6144:Ix2QdiglMFGfzIBeZO8Wf2cMRtCO/xZqqDLuz+4pQoL27aR9:IAQsgScEydtCJqnuq4z2mR9

Score
9/10

Malware Config

Signatures

  • Detects command variations typically used by ransomware 14 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe
    "C:\Users\Admin\AppData\Local\Temp\8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:4704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\59rg216xx1w1xs8te37ws3m2s8242nxb4ogy2dvqnem.dobe9cg0fr._oUfpIt

    Filesize

    2KB

    MD5

    814818279de7afc0849bb119bc8b6a96

    SHA1

    55994cd2a5a62db7b7ec8efb397ff8f5772a4ffb

    SHA256

    6d49f09c2a5241acf80978b85ff1474fa8168695da382f41fc66302905f1ab81

    SHA512

    7af4a1c0a928e52a6f67a241b1346b881bfc2f6bac055b86fd8356f435a0e6bc52a74742f26bca77591957858f8671aadc9e225fcabdc4808460f2dd49e2ad64

  • C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini

    Filesize

    903B

    MD5

    2f0ea49999bbf1c5ce7ca4f041cc6d5f

    SHA1

    ee304c36847acfd1f179b0851708778d8846517a

    SHA256

    477a112b2c1acf70f54f1741693ba00ec66f4949e8c640ecfe5c38d7f94f2578

    SHA512

    0a5a0375e8c97e925a07695ea5627fbfdc6b4b399c5fb68bc58c90ff9ab3ce04943ae2caea6b66ae2649bb5011cfa158c6cfea637d6f5f60e2c25575d03b0ff5

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore_amd64_amd64_6.0.2523.51912.dll

    Filesize

    1.3MB

    MD5

    fcaac7a84b95ace6b2b984531710c6af

    SHA1

    e749b273ccb8c6f5ad9ef695015a7779621ae96e

    SHA256

    eefebcfbf015093535e3776fdd9187be11964b7d4b361119a97be238f62df425

    SHA512

    fe56d2e9418ff6c01886c0485823980c4c42dcf65e84b0243e668dc2ed8b288ae7f563cacd73c4ec5f7b543217ff47fb7b43a54160a26b6865c8a89c06c924a6

  • C:\how_to_decrypt.hta

    Filesize

    11KB

    MD5

    7c1cc0361298ec5b1dd2813274eb823f

    SHA1

    50ed91e825cb0f464a6db1edae34e589557105f1

    SHA256

    b97e787f6d797ce07c05bac0bdc3591ae9b46ec8ab6cad7396a26ee31a664def

    SHA512

    da2e15f3a08818860cb9c840f1443f49350f7505a3672765507029bb7a3bd8fa2b8fb6421029425721cf50dc4ba1d7b991544f92a039a7f57afc02fd7e7aebde

  • C:\vcredist2010_x86.log.html

    Filesize

    82KB

    MD5

    81839fb2071b94389831df68cbb2f1b6

    SHA1

    76397eff58665ea5f4641fc0c04368da8069f91c

    SHA256

    9ec76c212b3b2baf8e43fb4a90eaa6f83ec756259b88069ce22fd23d415cec9a

    SHA512

    45f6ba0d40297c01f873530639151d5b5e0a438684483b5284f062ccba0b22c041ebdd79749b82b8f883163aa29490172e3cc45a2a241ba1c6e41e31482111d4

  • memory/4704-4-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-3-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-9-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-19-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-20-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-6-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-0-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-8-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-275-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-2-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-1113-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-1748-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-1957-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4704-1-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB