Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 09:40

General

  • Target

    79d7816c74a3c3e651ac0bd5a8756390N.exe

  • Size

    71KB

  • MD5

    79d7816c74a3c3e651ac0bd5a8756390

  • SHA1

    f8605de38588333619097501c6f659fe2d23c2ca

  • SHA256

    38b1ac3e9f8db8c0bf5138c676dab8898f21859e45ddfc9353f66f10ba00e6d9

  • SHA512

    d3e27e1be552b156b1328723599617c62160787603c0fb7ce1ba3cf67eebfd92b415e55f805ab07069b57a180bf4660f8b237ce21ebc65fc82a40850ff6f10f8

  • SSDEEP

    1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCIqwq+:enaypQSosk7Nz

Malware Config

Signatures

  • Renames multiple (4617) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\79d7816c74a3c3e651ac0bd5a8756390N.exe
    "C:\Users\Admin\AppData\Local\Temp\79d7816c74a3c3e651ac0bd5a8756390N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

    Filesize

    71KB

    MD5

    1c2217f9a7f1a2e4ddd3820664f958ad

    SHA1

    d2e5f9d2fb84de7be77b2eac9f1c5342d90c41d8

    SHA256

    e44012999db9b982b8035eac151035134d6c46e87ac9beafe172ce9d20f40203

    SHA512

    c98da7c3216140af27b6572edbe5ef689b930242c9e556af75c2f0dd6d0eb39324b030da58fe96f6d6f46136f9fd3e305fcaacc6a5f217efc558b202f28f65d7

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    170KB

    MD5

    024912ffc2dfec77654cfc60a58e79e1

    SHA1

    6290ac5b3d600b0ae4538b2fec266d6eeb77e019

    SHA256

    2c0d20e63dc8e92781bc8dd9055e37d5055e6f2790276c0dfb36f9a85299b777

    SHA512

    edc4c4ee69c7ff0950a818f0fcf6066cc5e74b143278e4119bcee40d28e8b7508b2a345388215eae1aab817ef10d85b6e56ecd02d1de995a989e1f3f84d667b8

  • memory/4292-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4292-865-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB