Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 02:44

General

  • Target

    9bff3bc81b9710bbfd0ba1db7011022bb2051a2f7352a4696dd9763f8d035572.exe

  • Size

    48KB

  • MD5

    e2b01d6171c15e1c07139b99384f2c13

  • SHA1

    e975a6676bcbb106b99e10f1a3d67cd367845cb3

  • SHA256

    9bff3bc81b9710bbfd0ba1db7011022bb2051a2f7352a4696dd9763f8d035572

  • SHA512

    4abf1a33247fe7633084a8ccda68296f015fccdcf62219ccd84a96f88fac78f1d6524fb1eb306c3d5d6ae994409ce2610aacf4c143567737c15304e20b29f249

  • SSDEEP

    1536:W7ZhA7pApM21LOA1LOl6vSDeNl3NIw3NI7:6e7WpMgLOiLO2Sj

Score
9/10

Malware Config

Signatures

  • Renames multiple (5193) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bff3bc81b9710bbfd0ba1db7011022bb2051a2f7352a4696dd9763f8d035572.exe
    "C:\Users\Admin\AppData\Local\Temp\9bff3bc81b9710bbfd0ba1db7011022bb2051a2f7352a4696dd9763f8d035572.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

    Filesize

    48KB

    MD5

    3c0b9a2f9d7a6442b2a8323bd6be6348

    SHA1

    acc0d6ce67610907374fbe3e4f21b39e57d6bbec

    SHA256

    40847b9ad712060c6ef83d614d91e13596f61f632d89cde4786d8de3576eedd2

    SHA512

    a61dc2142634ec85311c73d6bc0a2594a238b014905c3a26001960c1671b036fdefca41cc91e5f74977735de4427d7e19dac0ead281c3519ec30cda027e33990

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    147KB

    MD5

    827d8d8d487e9b0f7b0bf1538c641f63

    SHA1

    e6b6347bc64a099fbfb063e6b7701e55e65f9e77

    SHA256

    757f018506ed78892a2c3ceb7e2c6faf39eb6b0ee4acafd95ee6162d0341efb6

    SHA512

    5a00676595fc4dc9cba0c9e5535fdb4e6433588411eac7933ed3514de11ba599eb0ee20f513df75db35d959b5fdf10396d491c906f0453c92225e49b83b975a3