Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 10:10

General

  • Target

    7c14860a2d97730336c390e1b6d20820N.exe

  • Size

    142KB

  • MD5

    7c14860a2d97730336c390e1b6d20820

  • SHA1

    e7bf954fe61fbc9c7184d94f633ef56aeddc817e

  • SHA256

    9f1dfc70328484ae7c5cd7dc05378480545e0d0758dd6ce8e1c8ddfd65809815

  • SHA512

    425a82215b54903ce9a003bd2f3234604ecd1a616f6449c11a9acfc955a1e4429de6db757a80e0446ce58af5b0cfc2bbfe6e07976548b1893a04f4537258fe37

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8NCuXYRY5I2ISTWn1++PJHJXA/OsIZfz0:fnyiQSoDuXuv36QSoDuXuv3cimiC

Malware Config

Signatures

  • Renames multiple (4198) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c14860a2d97730336c390e1b6d20820N.exe
    "C:\Users\Admin\AppData\Local\Temp\7c14860a2d97730336c390e1b6d20820N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

    Filesize

    142KB

    MD5

    79a10a62d1f94be2eb63bb0bf82a325d

    SHA1

    53e2221bae72c12ffc44c0eef795acf69d8ecf1c

    SHA256

    6fb89ef7e2475deb45a360a71fb087e18e4b5be7b334908399f34161d8a2a6de

    SHA512

    4bcd92e0ac716ea6d0f3c26fde1a94dba0956fe5f17a6d875462efaebb4f890cee42696ec1838cdf3d5c85a21d470f13d26668acce04b88dfe6e4f5496750aed

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    241KB

    MD5

    2d305a4a1f7dc70b1eb156024a1f9e01

    SHA1

    abb0fc9027927b601bcd53ac7082004b63c537be

    SHA256

    6d12ad9eea1907b6e81ab3086bade3a379361c67c01f8796012265b336d22c93

    SHA512

    e15c3346062aafc2288c562951a9d869fd5b9f8130d8269fbb619c8ec65af0eb92b36e3a5cbb05c0054220233e36c18c3e1d4c90785422506719d228f87cc671

  • memory/2588-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2588-1740-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB