Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 20:12

General

  • Target

    3218c7a2f6e0575f328576df68288d151772e579b60a6dd1324297bb299da596.exe

  • Size

    96KB

  • MD5

    fd9d98df8e0a4dbaafa9a8f8553d1033

  • SHA1

    f4ea2535fcea280e5665f4aaa9b94e682143de29

  • SHA256

    3218c7a2f6e0575f328576df68288d151772e579b60a6dd1324297bb299da596

  • SHA512

    721436ed6147a577c12ebf6eef89bb2359b790fe42c94d06f1f924f86d9cdb1ca7bf34522c9272ce1ebd949ac1162d8840d8e01d809a4b95b008cce11446c641

  • SSDEEP

    1536:W7ZhA7pApH1IwVHykEElEa0NQn0NQie+ex:6e7WpnhkElEa0NQn0NQie+ex

Score
9/10

Malware Config

Signatures

  • Renames multiple (1064) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3218c7a2f6e0575f328576df68288d151772e579b60a6dd1324297bb299da596.exe
    "C:\Users\Admin\AppData\Local\Temp\3218c7a2f6e0575f328576df68288d151772e579b60a6dd1324297bb299da596.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1588
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3584

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

      Filesize

      97KB

      MD5

      1407eac03311aacdcbe1604c7aa306b5

      SHA1

      5ef8b9a9f72186b1dfc19738a1bfb332dd7de907

      SHA256

      5c0100a0606a04acf925c5b8c5143f11f96e76a398f1cb17c2af61c6eaff2c37

      SHA512

      ac166945c73eb5f7d84b432ef2886a5d500f84d3adaf8fde784987f1243c74619170804d7c35597ff322501f847f2a13f947a924f7e121e5d9aadae178f3653a

    • C:\libsmartscreen.dll.tmp

      Filesize

      96KB

      MD5

      3ea7b856536ef0a0bfe1000d61dde7da

      SHA1

      8fdcd0072525c2aa7a5f78b5fe75a815b3bb1daa

      SHA256

      f8dbb90cf85b9b5d1f3b48250fd8aa8e2c14a737a0a54c5d0642048216d89b1c

      SHA512

      189ec5005b845a20ad8ef358cadd3401adff2e8423af81b22a765218391ebe790a1a0a7215ef338474a07fb8ffb2e609b782025ef2499bccbd7778b7e06ad8a2