Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 18:22

General

  • Target

    e36f21fffa150e265b117f4414904920N.exe

  • Size

    108KB

  • MD5

    e36f21fffa150e265b117f4414904920

  • SHA1

    91ac2f61116a04a8d6c96487dddc0eb1c76ae7dd

  • SHA256

    4da8097d30de018927b5e67d5b34b086a04752c0120d17b738ddaf47831f91b1

  • SHA512

    069fbfe1b7467fc9e76c429a6e101ff10325acc76c3216791b957771cbe63e868ff266891fe2ab38b48dd44c669452d067f92a21aea14e80e806a28b4d2f8735

  • SSDEEP

    1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8z3ML9p5:6DWpwE7oL2e+efZwZ08i8z3MLR

Score
9/10

Malware Config

Signatures

  • Renames multiple (4363) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e36f21fffa150e265b117f4414904920N.exe
    "C:\Users\Admin\AppData\Local\Temp\e36f21fffa150e265b117f4414904920N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

    Filesize

    109KB

    MD5

    f4697da0dbdcb2f309e9ff6d8c63c465

    SHA1

    c3d6954ccf5df67fd7b6eafa73d94cc9d01781bd

    SHA256

    46cbb08f3fb90c4bb28f217b7ffe9b5a08524ffa844c10f3068b19cdb9fed5c7

    SHA512

    09eb2fde6033a501f03648d70dcb11e91e39c8ea24975a87ca9bd4f6a2e61ca03391ba45c35aa5c7ec9e49d81c000732b0576c1de63d7cddae3e46063db09c73

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    207KB

    MD5

    4aea96bd160f80dd24f872a97c632758

    SHA1

    34efee91967ba8c2dbd1e2a756d5aa8a2d99aaeb

    SHA256

    fd0639934f4d0417973b3c50bc443211e512101c7a40208b0b0d31347f3278ec

    SHA512

    d0f38e3f8303b27e750e36dada2087cdb87e3edc1624718f4c797468978591a7924fd8911d2f6a1a58d4cff2ad137090390f658229883d797d27521bce788f75