Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 21:40

General

  • Target

    0fa8974089fe15ae4a6528e814b7cca0N.exe

  • Size

    39KB

  • MD5

    0fa8974089fe15ae4a6528e814b7cca0

  • SHA1

    197579d7060de3de319ea859983c2b582276b3f3

  • SHA256

    6b44412f4372f8a782cbd1a5f86c8304a00909de0e447a623aacde9dfb0c45c6

  • SHA512

    188a5f499ffea0fbb5f7e784270bf82ce03c136f799c6bd304b61c0ab65993470ac36b2cb5178ece21b110d4a15b1aa930f30ac4c62668f0c122d82d5f68dd70

  • SSDEEP

    768:W7BlpppARFbhjbhQYjY+WyKoIWbsHfySkT5GeQbyi348oWc1RPOzkjId6q8UdrSn:W7ZppApBMyKoIWbsHfySkT5GeCyi348Y

Score
9/10

Malware Config

Signatures

  • Renames multiple (4371) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fa8974089fe15ae4a6528e814b7cca0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0fa8974089fe15ae4a6528e814b7cca0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

    Filesize

    39KB

    MD5

    1f91c7e4ab359532e1b978c03a440bcc

    SHA1

    896f1641492673c1b592b1b2ced2aed7ef818609

    SHA256

    04b11f8b93b0c8c439975d31d7ca5b767fd4348120b2870d858e9557244dfab7

    SHA512

    0e4b63f996ec9f87c7b034a70a5346571f6d4fc44a032c9a7815f7b2532374326f6ec85d8f65538f36663a3918e0df13d1d21a6f50240b58bc854a03b41c1d83

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    138KB

    MD5

    4248c060ec4ba1878f5119fcd9c006dc

    SHA1

    e7fb19411985ce04f2194103ee1f75b335e304e7

    SHA256

    3e2497a5abf6da39e3a41c5c9741e4728e8455513bceb5152dbd28307d48ecfe

    SHA512

    ba6bf5dd190509d089395c21933f14d67f9e863fd1dcefd362ee7fbf62fcf182267d96a385b6778b5b7252c86af746d04aa0bc1b5fcbc93d3b77d5794cbf0c0b