Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 21:47 UTC

General

  • Target

    08e9dd8c73ce5b2a1195197d2df5d240N.exe

  • Size

    100KB

  • MD5

    08e9dd8c73ce5b2a1195197d2df5d240

  • SHA1

    ae59c90ba82de1ee027051fd39bcb9cd4fdf0586

  • SHA256

    9ad57c5be5c7c718ad16c3f389ab2ad2394246733563862eaf3e281934530fc9

  • SHA512

    f28f7acca296084fae6164cc839131394be7e835636c0ba183fc680fb5c41a00ebb39725b52ad8b4b2052f17e33a4ea3524c93ed3590ab66a11bbcecf593c9da

  • SSDEEP

    1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8z3ML3+5:6DWpwE7oL2e+efZwZ08i8z3MLW

Score
9/10

Malware Config

Signatures

  • Renames multiple (4374) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\08e9dd8c73ce5b2a1195197d2df5d240N.exe
    "C:\Users\Admin\AppData\Local\Temp\08e9dd8c73ce5b2a1195197d2df5d240N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3904

Network

  • flag-us
    DNS
    71.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.143.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.143.123.92.in-addr.arpa
    IN PTR
    Response
    240.143.123.92.in-addr.arpa
    IN PTR
    a92-123-143-240deploystaticakamaitechnologiescom
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    71.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    71.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    240.143.123.92.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    240.143.123.92.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

    Filesize

    100KB

    MD5

    0b6511893a0092bc5bce68867b7e7283

    SHA1

    f1035eaee21195fb1efdc9a8f2dc5847b774e84a

    SHA256

    07e2ba975e77c73e12728c07d1f4beb404c55418f3ea5156c97031df94d8b814

    SHA512

    6c28f598ef215f15bd9bb057bc96c1bad8c79fcea1376510cff5da1a119dc360709fdc535c8587d81f43544b9594015f2335dcb25b01056f82b6471252aedfe0

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    199KB

    MD5

    3e5b1294f5f1c1453766ca37fe051fce

    SHA1

    8128c87c8d58c45461fce15c37829b3817e7d915

    SHA256

    cf1ec2f0973f41004890ed3d81b271934df49c2c71638bad994d1095a136c7c0

    SHA512

    758de0683f90f72c21e47b36aa9d3c03339deb4996ae409bef404059d29c0409fc555f947c306d8aa6a6a676f413c641dd1f8560f2bb0721c6eb9ea77a2caf94

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.