Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 01:21

General

  • Target

    82d26562fcd1112f323e887f968fd22df7b571f119ee5ea9702cd880f72a8622.exe

  • Size

    29KB

  • MD5

    2ece5d4ea2150ab05c3f16c59661b36b

  • SHA1

    b2aebac8cf92c56154bfe51240a1083420ed20d4

  • SHA256

    82d26562fcd1112f323e887f968fd22df7b571f119ee5ea9702cd880f72a8622

  • SHA512

    07df40dd7f50b647dcaf809c647f5979c72fdca38fd4fb3b0e564f4afeee49d7c77e3b192ddb93d027cde6acc20d247d113747a618728f2609e1cfaa8848794b

  • SSDEEP

    192:tACUADIY0Br5xjL/ScAgAQmP1oynLb22vtPeGyvyq1iGyvyqo:GBt7Br5xjLfAgA71FbhvtPch

Score
9/10

Malware Config

Signatures

  • Renames multiple (5241) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\82d26562fcd1112f323e887f968fd22df7b571f119ee5ea9702cd880f72a8622.exe
    "C:\Users\Admin\AppData\Local\Temp\82d26562fcd1112f323e887f968fd22df7b571f119ee5ea9702cd880f72a8622.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

    Filesize

    30KB

    MD5

    6c1a87481b6680fbae14641b83767518

    SHA1

    90c8b9fa8d5567cc07a7572027c56eec4047d68c

    SHA256

    0dd2bbac8146713f7b64c5db6da65f85502fdab94219558901ffe2c4c5ad8c8a

    SHA512

    51547dd747d1449b6851daaa20473f118501c983f0f1a79ea1c90b0bd5f4b45c4bca9f021361934ec011f65fdc35c85dba6e2f2b3f4b26a20d232cd895dcddb5

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    128KB

    MD5

    e068ef720887f32cdb04962710ae04d0

    SHA1

    4221c862f673a17502f9f8f317ed6cf290906e99

    SHA256

    59d6a45516fcd58a2f775ee23196de63b3ce692cf317bab33e2ff693b7d39658

    SHA512

    f1175ed71b9b8f215c542eafb4dd38b5c4e5c1b0bd1c8fb8df6cef73565feb86ffd988150ee86a600b4e7b2a8742ff0b510a97b87b34cd4b0372c0ff377c8a8c