Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 21:47

General

  • Target

    08e9dd8c73ce5b2a1195197d2df5d240N.exe

  • Size

    100KB

  • MD5

    08e9dd8c73ce5b2a1195197d2df5d240

  • SHA1

    ae59c90ba82de1ee027051fd39bcb9cd4fdf0586

  • SHA256

    9ad57c5be5c7c718ad16c3f389ab2ad2394246733563862eaf3e281934530fc9

  • SHA512

    f28f7acca296084fae6164cc839131394be7e835636c0ba183fc680fb5c41a00ebb39725b52ad8b4b2052f17e33a4ea3524c93ed3590ab66a11bbcecf593c9da

  • SSDEEP

    1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8z3ML3+5:6DWpwE7oL2e+efZwZ08i8z3MLW

Score
9/10

Malware Config

Signatures

  • Renames multiple (4374) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\08e9dd8c73ce5b2a1195197d2df5d240N.exe
    "C:\Users\Admin\AppData\Local\Temp\08e9dd8c73ce5b2a1195197d2df5d240N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

    Filesize

    100KB

    MD5

    0b6511893a0092bc5bce68867b7e7283

    SHA1

    f1035eaee21195fb1efdc9a8f2dc5847b774e84a

    SHA256

    07e2ba975e77c73e12728c07d1f4beb404c55418f3ea5156c97031df94d8b814

    SHA512

    6c28f598ef215f15bd9bb057bc96c1bad8c79fcea1376510cff5da1a119dc360709fdc535c8587d81f43544b9594015f2335dcb25b01056f82b6471252aedfe0

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    199KB

    MD5

    3e5b1294f5f1c1453766ca37fe051fce

    SHA1

    8128c87c8d58c45461fce15c37829b3817e7d915

    SHA256

    cf1ec2f0973f41004890ed3d81b271934df49c2c71638bad994d1095a136c7c0

    SHA512

    758de0683f90f72c21e47b36aa9d3c03339deb4996ae409bef404059d29c0409fc555f947c306d8aa6a6a676f413c641dd1f8560f2bb0721c6eb9ea77a2caf94