Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 14:33

General

  • Target

    8b71771750f2dfa69ead8ada455ca35ec29030e00e45a58af4a1f5006a1161b3.exe

  • Size

    62KB

  • MD5

    dea1c72890b2be5f646af9765aa9fead

  • SHA1

    2d96d82fc1f930109ad50fbc0630c184f355cd5d

  • SHA256

    8b71771750f2dfa69ead8ada455ca35ec29030e00e45a58af4a1f5006a1161b3

  • SHA512

    2a6b488cbafc769753c24ebd8c0696acaea58197150b62a98fa3bde55cc065a3d22db60663296b09deb6b8f41af9438f98456a31b95a37e79178adf55ff4f33a

  • SSDEEP

    768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhDps:W7ZDpApYbWjIoPyPoLzV7c6ShW

Score
9/10

Malware Config

Signatures

  • Renames multiple (5267) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b71771750f2dfa69ead8ada455ca35ec29030e00e45a58af4a1f5006a1161b3.exe
    "C:\Users\Admin\AppData\Local\Temp\8b71771750f2dfa69ead8ada455ca35ec29030e00e45a58af4a1f5006a1161b3.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

    Filesize

    63KB

    MD5

    319c195e3d4ad6667d3316e1f57e7c4c

    SHA1

    8f91d8ac55bc5d8b8b21c33bf8a89370f3a6ab41

    SHA256

    b6d75a128fd28c181c925c147c1bca6eeb2fe0ccc2584bb12fe8593decaa5367

    SHA512

    f55f9bad5c45db1cf499c6ea0c9004c9b67f12cd76152c60a2c761f77a2e37046ce01cd2d04324578c14a5e7f981a2cf79bc81f0855945979c9cc8b940498637

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    161KB

    MD5

    6676fe2155ee47830d2fa44a7aee143a

    SHA1

    632b50149d670c2ad604e9071391f5e89d39c65a

    SHA256

    abf52414b9fafd314bd0c9977c77d20a0cdf88b1586bb1857987fcd64bfcafee

    SHA512

    0eafd53b9ee8e0b8e93b0d08a9af87fbfc8d32fc7c76ab27399064fe708c010e3989e3bf9ad2f6e078e6f420345db8e42467e05a80c65566e6c01b148eea8932