Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/07/2024, 01:09

General

  • Target

    77ecbf499d84691d6433e491097a0fc0N.exe

  • Size

    41KB

  • MD5

    77ecbf499d84691d6433e491097a0fc0

  • SHA1

    28644e7c6178791b5a57d283e4f8243f2fcd3cab

  • SHA256

    5b8eb928ae32abdbce4f73f81ecffa35f9ff43fca6bac93552133106c47effc8

  • SHA512

    f28a2f0f4df07553c357065c74ed930f47e2a0f03a044c2238958afabf7419df3b20f40e0f2be8577427b179a11e865e61a8fc01c28435c30e79169ce6463bc9

  • SSDEEP

    768:W7BlphA7pARFbhL801VvM801VvcR2+lJtZ2+lJt9:W7ZhA7pApw03vR03vcltdt9

Score
9/10

Malware Config

Signatures

  • Renames multiple (1570) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\77ecbf499d84691d6433e491097a0fc0N.exe
    "C:\Users\Admin\AppData\Local\Temp\77ecbf499d84691d6433e491097a0fc0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini.tmp

    Filesize

    41KB

    MD5

    1ed593a7792662bc5e38f6184f32092d

    SHA1

    4c2d184c645454147dbeac07f04f016e5286081b

    SHA256

    06a976d4565a959325a9e51b5ff1eed66a7a6283da4dc00387c11f22a21f5826

    SHA512

    1bf9a348e81b08a94f800f0ee2dff19606a35a7ba6372349e81dd4571bdb9866fd55f5278522527d52ae382b35ce556cbfbdb0659f98f4790747f6d36d707185

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    140KB

    MD5

    089afd0f4f2bac3c4f3a1b517abda9f4

    SHA1

    e976babfd404f0b4a277468aee659248fc90e70d

    SHA256

    4b4880c722d041218d32f778a1f0e284dc27185e4408570595087b33205d55ef

    SHA512

    bc749b3739b82439e569916ed1268be103351516bd8b403b8d173ab0e2a1266a41dd05f8007b50f1ddd585eb103f24087451604415994512ec595623d29bfc7e