Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 22:10

General

  • Target

    5edd1d2fc7d6e26330276823a57937b0N.exe

  • Size

    460KB

  • MD5

    5edd1d2fc7d6e26330276823a57937b0

  • SHA1

    59147e8871beb0a5a219855d2db9a5d4e3d34cb2

  • SHA256

    15d309141ca995ed2f3bce4a1670126b30e96f5b1c670ccaf8a0a837235d34fb

  • SHA512

    32c4e3761a312da70236792ba65267f9ff7502e47e245a981f19eaaed54f1097a12dec82bfb7f2602f84135eebd47bde0e05f635694ad72f41f7936f95589975

  • SSDEEP

    12288:VQtxgNUhiHOR4LucvSFSrux88ndNtJXzLFziN:VI8UhiHOeE8rin3thLu

Malware Config

Signatures

  • Renames multiple (2507) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5edd1d2fc7d6e26330276823a57937b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\5edd1d2fc7d6e26330276823a57937b0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:5108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

    Filesize

    461KB

    MD5

    e0ac684e44ac26bb328fa5442f7fe72c

    SHA1

    7e166778650c513adfeb5085e7ced469d664d44a

    SHA256

    bfdb9d653c4498af3be79f9f6f539ddfedc8cded3f2a2fa783883029b0e94532

    SHA512

    d9a303b8fac446aa514382771a8765f0f1840d47d3721d168f3f4b902157302a2def5782536a5b3dcd90677fca0f2374e19e45845d04941a900b20ed9fb5326c

  • C:\Program Files\7-Zip\7-zip.dll.exe

    Filesize

    559KB

    MD5

    e3f360ad00784b1a24646018e796b077

    SHA1

    0f7d3920eeb4d35228a8a60e6e070e95df026259

    SHA256

    547b324461843af51bf7f60eff4054aa6740f0e18841b5dda55b34fcd46d4c81

    SHA512

    dfbf0e392bdcbc4b2b1a00b66b904a11769a3227608c3596874c33fe6025aceb37a8f892f7a9ce40694d3fee758fd825ee442d8047a8cb54dbfcc62653d16c05

  • memory/5108-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/5108-1248-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB