Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 06:48

General

  • Target

    6bd16feb8afaf233a42210718585bd50N.exe

  • Size

    69KB

  • MD5

    6bd16feb8afaf233a42210718585bd50

  • SHA1

    ff4f241fec7bc9fb78e9113dc810c5612e084de9

  • SHA256

    0b9e90ec65521f009af7ebd8e75f21b152f511fab64d1da1ea50c47108a4f927

  • SHA512

    3783545b2ccfaf43de7832d0fe1dbcab7fa1b0481a9fd6110a29dec86db266de9f3b739884147e0cb03b5694687e3041d18e7cdc40d62fbeecb7675c3f1be6c1

  • SSDEEP

    1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvG:6NLWpCZIzjwHwU

Score
9/10

Malware Config

Signatures

  • Renames multiple (4640) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bd16feb8afaf233a42210718585bd50N.exe
    "C:\Users\Admin\AppData\Local\Temp\6bd16feb8afaf233a42210718585bd50N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-195445723-368091294-1661186673-1000\desktop.ini.tmp

    Filesize

    70KB

    MD5

    aae6a4eb17470e7876a22fd48fb13ee2

    SHA1

    2055773877676ec6936b37f7abf372eea11ca702

    SHA256

    320b23e7291c65ab791a1d3ad3a59752e72c92b6e6a3ae6cd4bc2bdfe7d86ce2

    SHA512

    c1971ce9e440bb0e59afee7f46b4f876590445433cc2589a6e0adfe4d317069700938572f6167ee1deec3370b8c5f9bec0461bc85812b2cb7caa232d4a5da218

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    168KB

    MD5

    fb1861e70b9648c94c676f3beb7f57f6

    SHA1

    52b04928d15701b50fc7ea946b3e159003964d6f

    SHA256

    2d9772d0b5248828752fac2187795eb04cb5dc016d0a1d3f04685b3df307ea66

    SHA512

    78cc981adebfaef6983de5ad3e8abacb2f3de836d7c351f4ba7370107c600777c98f391afdb4866f8b19b3b1d36d29997af9532a2ea591b9c15bec929664eb12