Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 23:51

General

  • Target

    bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe

  • Size

    93KB

  • MD5

    c1b89eea3684fcfe040c9be9d0c16eaf

  • SHA1

    a8a91808ca8acd485326ca03d0caf9357c6ac098

  • SHA256

    bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0

  • SHA512

    cf44e168bd803f793bb60d984f2cbc177a00564d8872e0f8dac0b423d8f41b18958d23158e269db4509b2ede86d1462482e518821c4f3fac0ddffdec8d93b10e

  • SSDEEP

    1536:W7ZDpApYbWjIoPyPoLzV7c6ShZQ4PN54PNPw:6DWp4Wy

Score
9/10

Malware Config

Signatures

  • Renames multiple (5067) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe
    "C:\Users\Admin\AppData\Local\Temp\bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

    Filesize

    94KB

    MD5

    e8fae271cc65c9e1eed4ff482f10aaa8

    SHA1

    afc04ba74b37d137fd4c61e560b169f574b07536

    SHA256

    ed739820cc60d2c15319abf6cd233f9889e5d011863fd2ac0bb3bdb0d8696daf

    SHA512

    32b2b8bca93a0ce180396e9f8a9b576e6d7a5f9421a0d5db1ca8554a191ee0acc8e3b8ae3d7e868fdd44650e01a8f6f0e1d46303a8c48decc64b71a572cd45ce

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    193KB

    MD5

    242c225fb7da57c8a8e1fea99385bb5c

    SHA1

    0371689ead1e19a32a1105fbc12ee3c40dab9a6d

    SHA256

    b384390f7f6b4b837ee05778ac90ef2f6be4cc410272f5ad98e6cacf1a34f289

    SHA512

    62c470b9fa248260f400b8a4ff0ad50639367c5b10069848307d352dcba9763d3d93129ea94ada8eef5791ab348da47bd9a9258e9ce35752bbc43e34fde766b1