Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 08:49

General

  • Target

    b4456864a8c13adeeacd74f7662c3f60N.exe

  • Size

    72KB

  • MD5

    b4456864a8c13adeeacd74f7662c3f60

  • SHA1

    a8040b83bc4eade6de980bae3f7a889870c229f0

  • SHA256

    b56008cb24ff28395c5e24d1e2c300343a0fabaae054e85967760468dd0f3eb0

  • SHA512

    7a5257f54c087da591e4ac4b56cb71c7205afe4c4aa4fc32a5240cb4c9309f4c154e4e9dea228aa87e2b4a70571cd76477e46271650bd6584f309e9178f513c8

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WY:6e7WpMaxeb0CYJ97lEYNR73e+eGGY

Score
9/10

Malware Config

Signatures

  • Renames multiple (4371) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4456864a8c13adeeacd74f7662c3f60N.exe
    "C:\Users\Admin\AppData\Local\Temp\b4456864a8c13adeeacd74f7662c3f60N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

    Filesize

    72KB

    MD5

    50d1717ec262eeba431cc643861c3134

    SHA1

    3ea5fe12d89f9d3c96671adc11ffcc8f52626446

    SHA256

    bce4b529804e230332c55fb9c671bbad6490fedb5932464ebf65d4f9f27a4f75

    SHA512

    3f9b170740ff416bf21ce9cabd3d913fab5d870a9457e1581a21ca686911b4c5d8800a462cf2fb11e51595d65ede56bb5d65a5e8a1c36587388c01048b2f3c7f

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    171KB

    MD5

    c4a4179aa3fa986a24dc4d8d9f85d75e

    SHA1

    42c9269c1561258214967961a402cadeb71cf081

    SHA256

    4219fd7f4807e0b44497d79aef2d1b95c2e422808737964f9894f783d8854dee

    SHA512

    f09c3d6e3bf2b6ae8fa24b6b5fd036e22a6a73c9bde1bfcad10e5d7cb14d60caae4af1bb3ae82119fd702bfa7faeec2e0213efe18b4a8776dbfa8136dd6edf5c