Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 11:19

General

  • Target

    dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe

  • Size

    44KB

  • MD5

    63714a7f27820139e6443296e0d761a5

  • SHA1

    530b708c6f2d8601ab71ddf89ef0b2520dc2932f

  • SHA256

    dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41

  • SHA512

    6c57be9a94dfa7323ec8fe37833c904d46effc2dc4f8ef8acb64f3f7ebc159e975a2a8ec8eb35e81510fcf1610a8754d9a44d7575416cdfb876753b50ae91450

  • SSDEEP

    384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDc:W7BlpNLpARFbhblkYlkuvIYFWcDYcDc

Score
9/10

Malware Config

Signatures

  • Renames multiple (5211) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe
    "C:\Users\Admin\AppData\Local\Temp\dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    24cdf2f7f44b072bc088b44db36cac9a

    SHA1

    5d17732fc8782bd7fc56a16cf8d9e3df87ef668e

    SHA256

    1fe81184d6bacc71adf7445ead962aaad416a3110de5af659d115f972249c5d1

    SHA512

    ca65836574347be842f3c548978413b713b7f7e7f1b96919ac5124d4c69ea5e922ce02d84f15ab4ed3e5b47c2a0c9fbf19293e89f4b70c43f037c9339c0181fc

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    143KB

    MD5

    0503eb4c780f850b24c984732d5c2824

    SHA1

    6a0f946af730e8829c88bfa8d6e1af3c00a5ed1c

    SHA256

    7fdfbc81b4e3bf5da6859435a784b6fafdf053321eb05f77b6c6cc9cded1bfd2

    SHA512

    436fe78d6e976ffbec20508d3b8ced91bef2db88f53ceba1f9760910a9de1e420b3dda37cb322db78db5bef9f3f509ca116783e47acb2afa76983dd673fe369c