Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 18:33

General

  • Target

    0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe

  • Size

    198KB

  • MD5

    ecb392115be62d9994b4bbc1d8412dea

  • SHA1

    2cf640865c92733e64d615a6b13ef97b8a941715

  • SHA256

    0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c

  • SHA512

    94de20af5894c6656b57007fb62e21ddbc28feeafd2ea0396762eab229752b454f79e99a68aa739bd39cf798ea1463417dd1ee4ae639cb6adc71fc6425439b07

  • SSDEEP

    768:W7BlphA7pARFbhKKVeIuKVeIaCgx+qsaCgx+qs9lRlCE:W7ZhA7pApaX0aX09rB

Score
9/10

Malware Config

Signatures

  • Renames multiple (4787) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe
    "C:\Users\Admin\AppData\Local\Temp\0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:5052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

    Filesize

    198KB

    MD5

    1e99654c3ff1131055df7edd2533b257

    SHA1

    0be371e526bd63df7977461a9f369b12171a9201

    SHA256

    dda4d3f247dfa0f33ea3fad99a73f12557bac0455b5e54c1fe16bf3fa89e1cee

    SHA512

    d611793957a4789ce3e1326747a9ea72aefc5a3d8767cf7658463dc9392a6c8247dc3af9613ee2b4fc0447352ec38bf7b86b133d57a080e55a50b39eb40e69ba

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    297KB

    MD5

    c89b0a2cd60e4e41dae25de935927d88

    SHA1

    c7093f8a21976a75abb1dde3f25743f9856fa0ec

    SHA256

    9481dfac4ebf031b68ac94bb5d96034f6bc3827a04ebd4a769509437f9585fe7

    SHA512

    6e1eccb61f0ce20e81f610b197b158441620dbcf43bbd2caf0b72c2a4a068d76df04e9bd67a0027bde5a76a6fda28f875a2e033f05d0490ef16408b988e1797c