Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 23:58

General

  • Target

    e74f1eb6dba0ab993e093bf224785030N.exe

  • Size

    45KB

  • MD5

    e74f1eb6dba0ab993e093bf224785030

  • SHA1

    dfb16b82d1df25a3e70f15be268ae3d1aea2c363

  • SHA256

    8e8eac68b4345bc8a2a6d50ecd943bc82c8c87ede4e6092f08368c6fc2b82336

  • SHA512

    aaca869de26d2deec09d8fff7ad529f76120015a751c5124b23bf60900d34458454b487f446f1e8738e3d8326cbc6cbdb767ecd0f90307f4cde46ee191e7ef6e

  • SSDEEP

    768:W7BlpppARFbhjbhQYjYY4F2j3TK54F2j3TKdDa:W7ZppApB1W5WdDa

Score
9/10

Malware Config

Signatures

  • Renames multiple (4675) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e74f1eb6dba0ab993e093bf224785030N.exe
    "C:\Users\Admin\AppData\Local\Temp\e74f1eb6dba0ab993e093bf224785030N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

    Filesize

    46KB

    MD5

    000b1f289a01aa58843be9110260e33b

    SHA1

    3575ddf74cff7d4146bbbcd5e7000c5857db490a

    SHA256

    83eaf58d600a4db0d0762c66eb54e93f188e742a735dca84dc330e2ccd09102c

    SHA512

    aea2fc568abadfe9dedca2af52d2b807598182d8439e32e93eb7e1a92b95c62622d1fe51a284c5869b2d9dbe73a5932ed4285c8513e68441bb5e7c60643841c4

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    145KB

    MD5

    997bf97ed911c76369f4b254b8054d6f

    SHA1

    430b2e627f6a69ac49f49bdb1049df7b1d199586

    SHA256

    2512fe75f0428cb6a1ce8ed3adbc32eac77a62c998d4dbae61f621bd38d18361

    SHA512

    e2df7e96d1b488e1fc1d4f8507d41d4126351dbe5b34767a83f606b5ece15cd0f5b2433a5f1759c8523fe293d33ed771fff6435061ac5471686933aae7aeccff