Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 00:45

General

  • Target

    9b8a575aec5a610f3a604fb3a073ed2cba0e2037d1286e1630b6045eb62a257e.exe

  • Size

    43KB

  • MD5

    b9e3543abfa1f556120c0535b0b10051

  • SHA1

    efe49b5d1594e0fdc8929569f3fe3db552d9e130

  • SHA256

    9b8a575aec5a610f3a604fb3a073ed2cba0e2037d1286e1630b6045eb62a257e

  • SHA512

    8a01d32cda9cedd03ca44daa4f4bf3f881b0f7d76f27e020f7273cbbfdeea313b4628077413da12dee710cac83b021be8908640e18a99f56aa5427888ebd7850

  • SSDEEP

    768:W7BlpppARFbhHFoqAJwBqAJwNqikTqikB:W7ZppApyqikTqikB

Score
9/10

Malware Config

Signatures

  • Renames multiple (5111) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b8a575aec5a610f3a604fb3a073ed2cba0e2037d1286e1630b6045eb62a257e.exe
    "C:\Users\Admin\AppData\Local\Temp\9b8a575aec5a610f3a604fb3a073ed2cba0e2037d1286e1630b6045eb62a257e.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

    Filesize

    43KB

    MD5

    b2a7a3a75cf3b94b0c0d3f7231755f31

    SHA1

    a3d02bb28f6c64d309a327035f0141bca4916419

    SHA256

    dbb6cd5a58fea36914f4ef3a14e4e279d9fcefebd372bd67f6d9061613c3316a

    SHA512

    dfc347a89bc6b44b5775aa1cb5ff7ff253d531f32bdc5354ba309a0a0562d628c2b356eb4f4b436f92b8dc7ebe7837acefa52f50dc7f89d7daf0c01f53a86e6b

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    142KB

    MD5

    30f7350e9de929c15c1d0bb043847171

    SHA1

    d2c75291cf988cda3ef369cbbc20859856ce399f

    SHA256

    232056a64031dc46f030b6b962a378c2e1b89b63be513ebbb6a6720523981fbe

    SHA512

    03710fc57fab89aa7e4b4dd685a9f67b3927c1cb924f252c0db7c8f41244e051639899c08224b39c7db9fcc2fbadf722776a51e26d1547db791938ca8df7844b