Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 01:38

General

  • Target

    a4d19fac7137ee3597c2b6a1ffc236bd9a14ce10319f8b26f76ecacfebc8885e.exe

  • Size

    36KB

  • MD5

    57fdde5319c37ba788afc48bc826660d

  • SHA1

    cb63cbef3a67955e20e8fe3fe5c45b02bf53b0e9

  • SHA256

    a4d19fac7137ee3597c2b6a1ffc236bd9a14ce10319f8b26f76ecacfebc8885e

  • SHA512

    76deab6f7232cd59221840a88280772b30f2732a7d11874cbfcc31689e0e4cc0c8a7fe0a757eb6822344df86ebe99b44281f6a530edf9d227548a11897c5689e

  • SSDEEP

    768:W7BlpppARFbhjbhQYjYY4F2j3TK54F2j3TK/:W7ZppApB1W5W/

Score
9/10

Malware Config

Signatures

  • Renames multiple (4678) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4d19fac7137ee3597c2b6a1ffc236bd9a14ce10319f8b26f76ecacfebc8885e.exe
    "C:\Users\Admin\AppData\Local\Temp\a4d19fac7137ee3597c2b6a1ffc236bd9a14ce10319f8b26f76ecacfebc8885e.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

    Filesize

    37KB

    MD5

    92e9329c33a0ab00ba1b71714fbe4489

    SHA1

    47ad4c7a9abeb18fe0c46fa1c23c8bee6297f86b

    SHA256

    f172dbefef3cdcd82fe553e85e6473aaa6cf266dbf6c74277a21cb341f9ec2d1

    SHA512

    0584510369b521bfa1377ae1c104b8bd158e9cb72df113e76f42a1dace73f2acce0fd0784a0f664c8de1da743a7b8277990e9b1f2c3abeec6829a2ca6a226df0

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    135KB

    MD5

    a4a270a31aac802b960fc5c6254f1146

    SHA1

    e62497fa9708f56dc3865a31ad072b44b36b4a3b

    SHA256

    45e9d5cc508cc257182a2297ce99f126a9f1b8b16799a05548a5d8c8f0439d3c

    SHA512

    c384385fa43c5af5bac45e67a4881e423bf0d0d2c4a1ccbb57c2311cf88e6c19fb179e94c0e5e41901fb308663b403195cb4d78122568893a04bbb163fba840e