Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 00:32

General

  • Target

    8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe

  • Size

    195KB

  • MD5

    ddc7c7b6cf88fdf9727e29bef841e694

  • SHA1

    2936b6d8643df8eee5b7dfd7798114f2b144d4f0

  • SHA256

    8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade

  • SHA512

    f63f92e487f25e6483a0e76f6842a5a2286ff05f15cbd2bad573524ae7bd99a3e212ef15b0854fd0e8a862719fdedab0d4f0bd3bf206c518d11885451316f0d7

  • SSDEEP

    3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBJTzkf:RqKB+tOkWKR0iJ0lTzkf

Score
9/10

Malware Config

Signatures

  • Renames multiple (4711) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe
    "C:\Users\Admin\AppData\Local\Temp\8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

    Filesize

    195KB

    MD5

    ef4ada6fd40437ccaea964f2da54ae9c

    SHA1

    fac561ed10565cd66438df5225bb93398f3f9a43

    SHA256

    511b03276b5e22fd59750313b545a5eb3f30c29266c6712ee662b35a5966b387

    SHA512

    3c6f5f653fa0c14cad0ff246c4dd35649eea2c3bcef4fd3b4a26be9df72363bacc16b2edd2bb5d71eaf8076df48a2dc975e9a47fa13f8f868190b5a592bda58e

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    294KB

    MD5

    635bf131d3b59545c967e9345d126cff

    SHA1

    0657367352b0b3f7d58226ee485663ba9195daa5

    SHA256

    682d6df46b17d471d8803a0aa302264b7bb8cd26ef1edaf227b09b3d01b96c14

    SHA512

    336cc6c7e36a95611358bd8e325b7a8f53ec01bf37da7d4a649ea1b787fc2eb90533733daa27abc27e38b5687d222f74d69985f8c261194959ac9d3bab429777