Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2024, 21:33

General

  • Target

    5dcc11022dcef28b32f6072fe2cf3243219898c05ed0944425e8851de07829ef.exe

  • Size

    244KB

  • MD5

    c24389c33bcba5c0affa69178c80feca

  • SHA1

    ae2fa95372bb4d5f2d108b01d3fae5f8e5cbc4fc

  • SHA256

    5dcc11022dcef28b32f6072fe2cf3243219898c05ed0944425e8851de07829ef

  • SHA512

    616a8f1767605d43d08c53ad622d3838caefc38c5f41da774858d1574a2b1cf441e42e32fb2cd5888c7bb0ed20bb29de5c8d83dc80a425cf3e37b2c31e090821

  • SSDEEP

    3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBe:PqFF2Ke+eDJ2iaNSCKSkl3U73PU

Score
9/10

Malware Config

Signatures

  • Renames multiple (1835) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5dcc11022dcef28b32f6072fe2cf3243219898c05ed0944425e8851de07829ef.exe
    "C:\Users\Admin\AppData\Local\Temp\5dcc11022dcef28b32f6072fe2cf3243219898c05ed0944425e8851de07829ef.exe"
    1⤵
    • Drops file in Program Files directory
    PID:5100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3045580317-3728985860-206385570-1000\desktop.ini.tmp

    Filesize

    244KB

    MD5

    88d2b911f73b4770ced828a0dd024242

    SHA1

    ea0b0a8cdc9515866620a5fa9ee24ddae6e4a756

    SHA256

    046cc2d918d4ec8be3673867944db2805ff87ce7df4b9f82210a1f9e8fd1fe7b

    SHA512

    0224e279b6b8d873ac84bb2bf2c4dcd74516f50642476f3e6f35a3dffb1ee0a03e8d3599a57137a89ceac90c397ab91cf5d8a4227f6cb5f1de85ad22c8537014

  • C:\odt\config.xml.tmp

    Filesize

    245KB

    MD5

    7999e70c5a8da92f218513967428fb38

    SHA1

    c36d2b2ca1ea8ea0ab66e53245e531a61079117a

    SHA256

    abedb016f69831f45c2fcdbe78575e60566db9b03b85bcaefb64d1649376ab62

    SHA512

    bb2a6d870139db38e4f20f6d2fd21f007a0fce192eab29357b2f0052143c2eec2ea35df6599bc8ced5afadbb4f1353e9fde77a3e0b09d3c97469b6e2f2ed3ef0