Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    92s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 06:15

General

  • Target

    67012c1911a76df2c8571701725e1a50N.exe

  • Size

    96KB

  • MD5

    67012c1911a76df2c8571701725e1a50

  • SHA1

    6cc539261b2ef3838e6046139fd81d11d5d9a026

  • SHA256

    24e2b748663586f9126e95ff212b0124f327195cca6c01ff2f3a60f000178328

  • SHA512

    d4f6af74daff74ff5c992c6b67dd9e57b6ad7ebd4110849f7b07297d05776f66d517bdd8cecfe81ad5c3136701ddd05785bc8735c8cf70ecf93ea72f913f3845

  • SSDEEP

    3072:fnyiQSoJUBM+PocOQejPdMRAHAASnnD5D5172HyZU3YF40S5DnumSFDnDHaJP1Bc:KiQSo//PxPa

Malware Config

Signatures

  • Renames multiple (4338) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\67012c1911a76df2c8571701725e1a50N.exe
    "C:\Users\Admin\AppData\Local\Temp\67012c1911a76df2c8571701725e1a50N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2927035347-1736702767-189270196-1000\desktop.ini.tmp

    Filesize

    97KB

    MD5

    7da10b84357d7c112c17af5725c88184

    SHA1

    279700790158eb40d290c21ba07aeb3abaaa1649

    SHA256

    06d523eac39104bc015256d8fe8f628d90ee74a9a45cdbb8567889eae3d130ba

    SHA512

    2beb1d05a8634242d31870b0677fa9f43908b3ed03a303a4d6767db227f6e71fd1a36dfa9268f1d68364af0358ffdfd54a9ad103f5f70bc4a1d9a4459eb0cf31

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    196KB

    MD5

    77628a84c69f02deee44b1b308f82af9

    SHA1

    ea35784a79dc7d8354f19c66eda8165bf9b3cf79

    SHA256

    17340af617096aaa9df1403e7d5e0484234ba357bf1af0ebf4e42fdb2e031988

    SHA512

    9cae4311744a63a30dd469c8a30315fb07a4bb39e803268ef6ba266da4c0c3109383bbca3a78678cc84719964ca775400ca9db4ee2e9d946ec0530c512cf858b

  • memory/3916-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3916-1788-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB