Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 23:27

General

  • Target

    2324b90ba84d9ad44e441c9033d14ef0N.exe

  • Size

    60KB

  • MD5

    2324b90ba84d9ad44e441c9033d14ef0

  • SHA1

    c4010cfcc79dec381fb5b010fd7da76a11a96ca5

  • SHA256

    aedfa7068ba1d3856134f25073e740ed936528ed104917df024a478d8f348d17

  • SHA512

    972076abb8c9f3f881067be90d0b2c4d8bec852536d4c18501f882c9a4c78766f5f6654a43c0ee2d2b83283fb0b7d4d862e7efa81f69d1d9aa3494932ad5404a

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rq:V7Zf/FAxTWtnMdyGdyvsb

Malware Config

Signatures

  • Renames multiple (4678) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2324b90ba84d9ad44e441c9033d14ef0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2324b90ba84d9ad44e441c9033d14ef0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

    Filesize

    60KB

    MD5

    6dddb9a2b057551475eeab4b5e10309c

    SHA1

    27511b97cfb9a9ea1b8f2c27291e147ec29f1f3b

    SHA256

    b6bca1598e9afb53ae3e0a91e6035662527697f59904e4b4e37df9c04f3a29af

    SHA512

    9b7a77638b07b82c6921b6c671859d4a09f4991d7a69862ae3fa1d4792122cc45b0d4ec7a2dd31b86fc851c9a431f4fd2f724a4518281e29e05deb72858e8f5f

  • C:\Program Files\7-Zip\7-zip.dll.exe

    Filesize

    159KB

    MD5

    18d276e7270e276d03ba424938822375

    SHA1

    21809cbb6121d793cadf72f70f5f7407a9bee70b

    SHA256

    1a9a046738619dde5e45a62356736db6cee241c17b495871dddc5a0597dab2da

    SHA512

    87cc4c15dad9b3f34c9982060e87a18499738c63b64e1c60a653adf5c2b1ef309941597b88dba8a8018cb59a2057ac25942497a51fa62f8c0d976ae31c716142

  • memory/3972-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3972-1970-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB