Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/08/2024, 23:27

General

  • Target

    80f1882fbf7d930a5a069010a5adc26c568b5db9e8d9a7368bf10139464b5bb2.exe

  • Size

    77KB

  • MD5

    c294311e04c7aa4be1a0ae4540ac2a0e

  • SHA1

    606bdc962865ca273d6257e6f2b21c132e8b4839

  • SHA256

    80f1882fbf7d930a5a069010a5adc26c568b5db9e8d9a7368bf10139464b5bb2

  • SHA512

    0cb3ba216af3f63e3a2e9d6dc32566829952ca3d06558f67c9e37905383a6bd4227b310dd1f1eed22ee923dea51c6b8aafad3690a9498f014610c8e978667b1c

  • SSDEEP

    384:yBs7Br5xjL8AgA71FbhvJUfWGUfHjtmjtd5NaMR5NaBQNNXiB:/7BlpQpARFbhiWb8naOnaBGNXiB

Score
9/10

Malware Config

Signatures

  • Renames multiple (5097) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\80f1882fbf7d930a5a069010a5adc26c568b5db9e8d9a7368bf10139464b5bb2.exe
    "C:\Users\Admin\AppData\Local\Temp\80f1882fbf7d930a5a069010a5adc26c568b5db9e8d9a7368bf10139464b5bb2.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

    Filesize

    78KB

    MD5

    2c5b949077122663b7f03a6f0ee25764

    SHA1

    dc30e5bc58ac03c9cad5331a269657fdbad3a5c7

    SHA256

    1792c3255d60436b667a16657f3028b6264733f93c19388c24aa40668b641702

    SHA512

    d20757dc1ba75c17001c71d96e098d5beb2e8fff508131275d46dff2355e6c07bea145ad605e92190115893e1e9cbb2e421de9a301a7010788950c248667b2eb

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    176KB

    MD5

    20ec58c7f4ed2ade47e9a2f34065a7f8

    SHA1

    87767f5759471059101d83e26d81522ce5551e5b

    SHA256

    22e3bbf35ead40a0e74481e9318d0e3aa8181e1d2d857c7c0e3152536e98acc9

    SHA512

    7b7c7e63fcb061f78ac4a4ed571c8f5d4695ce0b38b0383589e3352055aeb39f503affae3c62acb6ae5e09620c7c4f4f330f07cf0a80d563424c5b9fb9197131

  • memory/384-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/384-1796-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB