Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 19:04

General

  • Target

    1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe

  • Size

    36KB

  • MD5

    a708f35d7b2ba0201fea61c93fba9bd1

  • SHA1

    41a3fd42e1fd1e69988fc163ba4c28e9c580c243

  • SHA256

    1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a

  • SHA512

    9b1da750530be910fb45ea92f0a3d86022d7a4f84dab4fa06c8617785b9265e18ce247a04d1a1fcbdbecb2d8b4fa87ae1691f76f508a46599c9d1f7b2721e3fa

  • SSDEEP

    192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpqW7U7OB9N73t9N7M:yBs7Br5xjL8AgA71Fbhvszwu9NDt9NDc

Score
9/10

Malware Config

Signatures

  • Renames multiple (5335) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe
    "C:\Users\Admin\AppData\Local\Temp\1298c210f292acf32b745d982972b2117d819a34b4527289425baa7c1973cd3a.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

    Filesize

    37KB

    MD5

    5ca0a907fbfd976aa9584481ef041832

    SHA1

    35843dee0181b78545c62dc14ce1c9b35d352533

    SHA256

    72c391f7ae928c915fe23ed41287aecdc61a637630057a6b5a0b94daa4644e68

    SHA512

    a573b22f85edef042733d45540b8d86fd98b7676bbd13013668aa486bb74812a36027f5af036607a105c153b746d8c7477ed31a90c6322b5d5d5bbf0be27f121

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    135KB

    MD5

    cc64cb1e7ad60385f1e557ed451ea041

    SHA1

    5cad0a3575917984495a19ca589730d0da1636a1

    SHA256

    4889361ec0a893c8234b9197e50ba963b465cd319245fa057f6fabf58753a849

    SHA512

    1c5d9cc1befba9f0ab9e1cfaf0ac3e9c4e23e25bedc87c1417d8f317995b706b9ef1924da21f611d34d6fa22c678449e03e3157c10bef2baabf698e836867106

  • memory/4776-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4776-1012-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB