Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 20:51

General

  • Target

    36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe

  • Size

    76KB

  • MD5

    7f5617fbb5a7bdaf41972ab4fe135fdd

  • SHA1

    78c96f9e9e6f7293d68e87817f4ff9519b9d7da2

  • SHA256

    36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2

  • SHA512

    7db4767394f483dc87f8ad4b1c3fd3da661d7bbf3624b85c1d6358d739b6c47991403f6cf3f9303ba3663378a474d5d6e22c447d17944242a5429f8c6ae943fb

  • SSDEEP

    1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhA:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsR

Score
9/10

Malware Config

Signatures

  • Renames multiple (5185) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe
    "C:\Users\Admin\AppData\Local\Temp\36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

    Filesize

    77KB

    MD5

    4d8d512b7443dd23a31f1dd7676ea08b

    SHA1

    9cd2b9d09eecd739d7b8bd75b4362b1f37680ccb

    SHA256

    10f9ca2ac542a6f3d0229ce8287f00751f65753c067953c73858669d4f551b58

    SHA512

    ab709a69c7256b3ccba02328bb8dae599148ddd86579753632082c3390c4c7957e81890abda3d9589db897dae19a9939a9d7a4ae8e46b891fcb7a9ddd48bd15c

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    175KB

    MD5

    f644976b341bb0fcb714ea7fd9619df1

    SHA1

    e26f387cd6a655d0477d756dab76abb5b658a78f

    SHA256

    afd32ae8785f8c342ea1edcf90b083ca187b4e4274fbc6e13212c8b1a3e9fe6f

    SHA512

    121b757962e648339cca853a7b2dd7957b9c8b45fbb6db453e4a02ed68156793ea24548a080bba65b07903a0cd98612468b383510cc4ef9898441d65232f0de1