Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 03:33

General

  • Target

    d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe

  • Size

    36KB

  • MD5

    9073a9e4d27964d4bfec7dcde7fb8de8

  • SHA1

    a15f1142948c4aff53437720a92992c0a89bceb6

  • SHA256

    d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672

  • SHA512

    5618e1833f77932bece5fc209a9e1cff83a12d91a5ec8f8712df399aed54017c05818c75a1d0de1086e539b862941415a998c49d43901350f72d29b2f46c60f2

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tizKPKg:CTW7JJ7TTQoQza9

Malware Config

Signatures

  • Renames multiple (5273) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe
    "C:\Users\Admin\AppData\Local\Temp\d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

    Filesize

    36KB

    MD5

    a7ac5542ab3e0b8edb898863bd63e7c3

    SHA1

    009b5552bf9bf911c0a654b464f5ee2a714e4364

    SHA256

    31f4cce68408505193878d22fd2349e7e3f4572e4a7524bd01b6f036455e0bfc

    SHA512

    aeaef92c1e31e98275b3a429d2bb3052b179731813a65bf5b2c7fa4ad1a77f83058935a3be73249cf46b022cb4e051e806a9a829a60f5f5cf55f7cb3458432cb

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    135KB

    MD5

    fade681e3ab1c58ced438363650ed22b

    SHA1

    bea0f207855e8b6f3417816cf2cf594848b9ad76

    SHA256

    81e06ffbf263f8abaecc279993db069f79976c01082980785e7fd0442ce8d3b2

    SHA512

    2aa36c8f43ecd12b4e85ae6fcb9a47077aeea27e32a6a6a6480883cb76fc08494370b2028918ee23d9ac92f80c413ad86be981bf8d9c38d5e78cf9670d21caf1

  • memory/1848-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1848-1220-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB