Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2024, 23:11

General

  • Target

    6ad31d4dd8e8ea567aa6aeb8ccedc1f142510f3a7cd62e107e69a2785352ee14.exe

  • Size

    75KB

  • MD5

    01e047e571b14284314119b6bd972397

  • SHA1

    8f5810e18bd118fa16810d50e0e206def42313af

  • SHA256

    6ad31d4dd8e8ea567aa6aeb8ccedc1f142510f3a7cd62e107e69a2785352ee14

  • SHA512

    474f375341702975bc9409ce856e3593f604baa6bb2570d6fc33ba7e066d502b8e4d05ab12feb715869addee69427745568ebd7e622ba3b0f4c0f6bbcc33accb

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Ppe:6e7WpMaxeb0CYJ97lEYNR73e+eKZA

Score
9/10

Malware Config

Signatures

  • Renames multiple (5101) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ad31d4dd8e8ea567aa6aeb8ccedc1f142510f3a7cd62e107e69a2785352ee14.exe
    "C:\Users\Admin\AppData\Local\Temp\6ad31d4dd8e8ea567aa6aeb8ccedc1f142510f3a7cd62e107e69a2785352ee14.exe"
    1⤵
    • Drops file in Program Files directory
    PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4084619521-2220719027-1909462854-1000\desktop.ini.tmp

    Filesize

    75KB

    MD5

    466f9f8b3df068d242637a1213e31c65

    SHA1

    c23330692191e2532dd854ae61d3398a99e26a3d

    SHA256

    9be5291c6a7cc50ecf6abb9a291a9c2636423e6f4bb21d9f2932a4f3ab551082

    SHA512

    e1403d975fcd214174079a678d9f895bfe4061f3f2411d9abb9a3dcfa6d1ead1a9840b5d98fd4a8e0020019b2969ab188625df1c65c4c5b59e26312bba55b439

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    174KB

    MD5

    7d22d120e00ae5c4ee8fc5373fb66307

    SHA1

    bbacc4fb5842a8f1f0516174a2ccc56e9acc75f8

    SHA256

    9e509f4b206fc62be12db1ecc3553dc4568150774d1e1f60c66bf45226154414

    SHA512

    da6b98219922375228b7aa2d28ea34c8d5e93ecf5f1c705f5591ade2546ac3a301ffd42685cf7044be944487840e066b9113e70a278218d2c546cde543248800