Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 17:35

General

  • Target

    f52c01bea7ead4b6eaa6498576294540N.exe

  • Size

    270KB

  • MD5

    f52c01bea7ead4b6eaa6498576294540

  • SHA1

    fa666acd8cedf975617258b2b3a378b0b304df6c

  • SHA256

    55de429ca7e826eff2525cac4769896b2afe26c3cb5fb8b364665d06e551069e

  • SHA512

    2c0f7b8dd654fddb1cdbd09e11458f52f264be0545f64b94326a39f1d5077927b30cf52fb224a6b556303dc8b28eada51dec7bb3a8dbead5f2aad0fa7b9ff966

  • SSDEEP

    6144:RqBAIuZAIuDMVtM/8aB6Up31XnSUJdrIP4z:CAIuZAIuO/6lXtrIg

Score
9/10

Malware Config

Signatures

  • Renames multiple (2922) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f52c01bea7ead4b6eaa6498576294540N.exe
    "C:\Users\Admin\AppData\Local\Temp\f52c01bea7ead4b6eaa6498576294540N.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

    Filesize

    270KB

    MD5

    c0b69a2117d50916e8c1d202c9639689

    SHA1

    e779ecf39dec2170ad477fc11fae90426911a299

    SHA256

    f2e5fb00fe079aa0cd645033fd0811589914dcf7f1c46500cd76695f97c90515

    SHA512

    b211c273294d03f2c487a00ec62154cb5709a3d3e6975874385035108377ed070e1351469685017237f8ff9365e60d8ede3afac792bdaf1fb168c2d190ab26a4

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    369KB

    MD5

    7272729f60a5b815c2ac8b0ba1a0e5f3

    SHA1

    9cec8d058a90df3d6213157e3f7469ab83445771

    SHA256

    5774c70b0fa9623af01cc7dbe53f1496f6142fc8294fae3a0414dc027ebda9d6

    SHA512

    396602dfff07e6acf71bfdb66d5075812591d272cdf88f23e0f1cd3513ef0f20325d43925857239db38cb730611c4a7dd856851e72f48bfefc5fbb63899e11e9