Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 21:29

General

  • Target

    4faaea57adfa8fe9d5a9f8259da956a3d33a0a491c32e9787636dacf8da108ec.exe

  • Size

    72KB

  • MD5

    65bccc3375e11848aefa0225ac97f39a

  • SHA1

    29e0bc7bc70f632e814e404528666c491b4b1eac

  • SHA256

    4faaea57adfa8fe9d5a9f8259da956a3d33a0a491c32e9787636dacf8da108ec

  • SHA512

    d5944665f2e82755cc4d69b724a34d6e235509b3c67833de26bb16fed50b8958c8552b2a564d35077559e2189938abc1d1f7a42d144b0011b2bb9edd4c40b3e5

  • SSDEEP

    1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhA:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsx

Score
9/10

Malware Config

Signatures

  • Renames multiple (4725) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4faaea57adfa8fe9d5a9f8259da956a3d33a0a491c32e9787636dacf8da108ec.exe
    "C:\Users\Admin\AppData\Local\Temp\4faaea57adfa8fe9d5a9f8259da956a3d33a0a491c32e9787636dacf8da108ec.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

    Filesize

    72KB

    MD5

    4cee56be596ffe6ca53c692c307345ef

    SHA1

    20e3c4f54421b044afb712985d251cca55250784

    SHA256

    6701e42d3a0f01d4e6922b95ef205910f06fa2b27b5b2890f2631ea863508b06

    SHA512

    5ec3bd7cbef0f47892bcc3963172661472ce840b7ff2d1d5413a7b2a9d45ca2175e2a90f7365a51947bb6a3df5ab593a70c2b80f2bb53403f97c1acf52383079

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    171KB

    MD5

    18c4fe7a1d32010f645d5872af65b481

    SHA1

    97a7e5a0b548c23b8198bda238f2c0605eb3f8f2

    SHA256

    f64465ca2e1dd0eb892335791f378430abf31caa4a4a9a026ad01fd8baa8687e

    SHA512

    96def70de2b1c174acd2188bf411604d6978d3e9bd746404d9b96dbdd30c0034c9bb50c83403abaf201c3b246f11c0cd14f733c4028b942994aa033f35a0fc61