Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2024, 03:28

General

  • Target

    d6d4006ac14f1451d97039e14597a043f43bd42bd5f22ba13cf277bdf912a65e.exe

  • Size

    69KB

  • MD5

    fa8295654fdca9b7693284dc059e0a31

  • SHA1

    827bf98545fe6d4266acd7db7229bdbf58a8f838

  • SHA256

    d6d4006ac14f1451d97039e14597a043f43bd42bd5f22ba13cf277bdf912a65e

  • SHA512

    eaf2538fcee7ab27c17ccaf1a624979282982cabca0244b6e93f2e98c7c27c8cc824d2a015aa0deffe90bdd2db2354e2c501e4d7069a6b7b7ea2ea41e1ca4a19

  • SSDEEP

    1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tf:6e7WpP9oVLQthbYY9oVLQthbUrt7tf

Score
9/10

Malware Config

Signatures

  • Renames multiple (2295) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6d4006ac14f1451d97039e14597a043f43bd42bd5f22ba13cf277bdf912a65e.exe
    "C:\Users\Admin\AppData\Local\Temp\d6d4006ac14f1451d97039e14597a043f43bd42bd5f22ba13cf277bdf912a65e.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-776854024-226333264-2052258302-1000\desktop.ini.tmp

    Filesize

    70KB

    MD5

    19099f6d1a023aff0f551cde531d4a3b

    SHA1

    02bcd1eb81ba2fdd18563e99b90868c5ed04ad43

    SHA256

    4edfc6776ce60a1663a3fed85023ae305863247f5663df1ffa3a972e0c03ffbf

    SHA512

    05a4b6652370db2b1b59c1f5e55071212dd4271d79055e939d860f0ee9d69dbcf8826a4977784be92237f5f5cc64a65d7a44ddfef8d80c6070e3fc74cac66ee6

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    168KB

    MD5

    20f24cbb34cdc199e4a667fccf816566

    SHA1

    911005c32cfe469332f4c72c749f3b4f742ad8b7

    SHA256

    a002fefb300c273d80e7b3b0ba653288a2094c96d9b670e786005c6e69300931

    SHA512

    215c4ec1f489bc779260e0d174ae63c5c23a41335cf530718886a27a2e5ca4276cdd69a6492fcfd15b7501925ef10949715ad83e9be33e2305dc1994a8a0dc05