Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2024, 05:00

General

  • Target

    e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe

  • Size

    47KB

  • MD5

    c0ae79c9ad6d34f4097303c53db409ae

  • SHA1

    9845e0a1be0ccd9bd6b47ae58df07ee4a1ef465d

  • SHA256

    e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5

  • SHA512

    17ffbfc20cc744cd28624649e74f09de290dabc05d5b03a988aeac5a335bc36aaa3ec707fb0a2c5cfbccfaf9af1663ceb0e52adf0191fd20d702222a768e8fb8

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0ifxRfxSqAJPqAJz:W7ZppApBULcfpHLcfpX2/Nw/Nw8fxRfG

Score
9/10

Malware Config

Signatures

  • Renames multiple (5250) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe
    "C:\Users\Admin\AppData\Local\Temp\e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2052
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,7761714625659357865,10802238739796857379,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
    1⤵
      PID:1824

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-661257284-3186977026-4220467887-1000\desktop.ini.tmp

      Filesize

      48KB

      MD5

      76fb93b09445a797351afb37b63940e5

      SHA1

      17bb04274818f43d0a752d11a326f914b80d398e

      SHA256

      12b8284bb6d346982cfd37218c545fc6589582512cda7b2dbb7f9a5b98d17d60

      SHA512

      fa92b783927b4bf73b459ae0a485d0059b30cb96b68ef50a085c52cba9ff60eadbeae33bc733134c58d5ecebfd5ff7aa76c305c9e101159e81b17cf16354c50c

    • C:\Program Files\7-Zip\7-zip.chm.tmp

      Filesize

      160KB

      MD5

      d941883a11cf665beee9b71a7cb8a9bb

      SHA1

      2fcfb512a2356b38f534807bb0432cce79a44b00

      SHA256

      79aa5e74429d10fd399f446dd10895d397a8986d4db8ee8fca69588429d32f55

      SHA512

      a0671c7a27d14372968a6d013ad92e6eec810a7d54600f61d8b685124a650cd8ee695ce2d77fa0e00c13c2677ab798e3f4faa4ef42850814b6e10a55f432e510