Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 23:21

General

  • Target

    11063146dbe4eda3617dd638418c29b0N.exe

  • Size

    42KB

  • MD5

    11063146dbe4eda3617dd638418c29b0

  • SHA1

    ba2c4a1e9975bac8ddfa4ac6362d694198501b50

  • SHA256

    a9e16f6c17371ae272e35b945a2fe87d1999cc07704312e8f981d9d508c49594

  • SHA512

    2da9fb3aae98fd7363582461061e40bc3c27dc331ff923546e2014aa1e4e5eee4d0314e488f921cfa2b8813f37dac381d19a4a19448413cc779ffba137fb066d

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti8cx8ojzcx8ojQocHEocHL:CTW7JJ7TTQoQTWojQWojjqXqL

Malware Config

Signatures

  • Renames multiple (4680) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\11063146dbe4eda3617dd638418c29b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\11063146dbe4eda3617dd638418c29b0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

    Filesize

    42KB

    MD5

    937cc9b6133480650a58dfa61e5f412d

    SHA1

    dbec5f3d35c3a0af232d580d1a256d6a32adde6e

    SHA256

    8115d3a773174a7cf0de03eb939a129f4e979b45f94735a8cb9f6259731031aa

    SHA512

    14a76996994ce1c3c7cca81db172a33ed1975be5532561c09c82a8c8526bbc528d05f9e9e008b58894abf8f06a33117e694ffca11a1485bfad543f71ba50ff0c

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    141KB

    MD5

    86f9377298562fc3a4cdef1167e546b0

    SHA1

    a2826b3d67b3884a9a4b5ac3aab4c433137ad4ba

    SHA256

    604da8650ffa52c76e6ed18aaa302ab4bb170fe8710e5a4f902db7f952776a4d

    SHA512

    a730810895b8c1ea8fd77dc580abdc6011b456fa3c75c0eb4023489e060e35abda80ddab84908a1a422e7be599a3cee859de8551317545628eeab9533a818c21

  • memory/1352-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1352-1196-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB