Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 13:37

General

  • Target

    87f89e841c0b69303bb5f5d8465dc670N.exe

  • Size

    102KB

  • MD5

    87f89e841c0b69303bb5f5d8465dc670

  • SHA1

    b9a796dcef27e2d7803783f7c1658d07c674c7b5

  • SHA256

    50504b056c6a8de9609e0f1a9a15b534d428137e86398c7e1bf4d9fd22f79b21

  • SHA512

    258f4d495cc38426cfcaeb7d60406d58acacee4f09e385233f226b44f45bacbd7009547d47d1d211134144cba7bd827cde143acd1e26729b1338eda24d53e490

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9il72c:RqlIyFESWu0SWu86jYl72c

Score
9/10

Malware Config

Signatures

  • Renames multiple (4319) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\87f89e841c0b69303bb5f5d8465dc670N.exe
    "C:\Users\Admin\AppData\Local\Temp\87f89e841c0b69303bb5f5d8465dc670N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:948
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4300,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:8
    1⤵
      PID:1228

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

      Filesize

      102KB

      MD5

      99111a6385a9e7f42e8b0f82b9bc027a

      SHA1

      eae4a644e2fa5270f53758e1c780ee5ac61b2b7d

      SHA256

      9059f3b6c5d3073d36f1dc118807c5e59edbd64a97d420d78fa16c9bcc5b2943

      SHA512

      9dba82c5717e03deaebef9cc767cc49965c75141a0eb60d38af5cec6690b7d85280b9fc1065ae5ad19cfcff0993b9bdc6a3a4db565b6422f45aca308f9f8a62b

    • C:\Program Files\7-Zip\7-zip.chm.tmp

      Filesize

      214KB

      MD5

      11d59bf233a1461a77a6d8ac31e0f8b0

      SHA1

      a601ca5079800ee3c8066e4d8ec6412b8caa382d

      SHA256

      b8a4bd95f8e35f69379660700df3068e6a7ac011685b7ad01aea82315841ee16

      SHA512

      6619f8abb5be89af5171ec7dfb3dca30e894022578af1e255ff48deb26fec743baacd0a8f268b5d346ba043643ab234fa31ee0e56af8ade45aa6dd9bdb0f6b54