Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 08:49

General

  • Target

    672b7133a313afd9ec5178569a8bb170N.exe

  • Size

    75KB

  • MD5

    672b7133a313afd9ec5178569a8bb170

  • SHA1

    9ba858230c3e0df0bd652767bff92da8f0a7fd4b

  • SHA256

    81b2ee8ad7826f1ac7fa1a9d4367a32a0c73fe2fb01d0930401d85e41f0cbaf0

  • SHA512

    8fcd63471bd3b57759e574f5776ce3fbcca200e63dba2a098e059bce1092403cf327cbfecf3d88efa90df9a9275829912b9e0630c80824ebf14eadfcc1535a77

  • SSDEEP

    1536:/7ZQpApze+eJfFpsJOfFpsJ5DVSWu0SWut:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWut

Score
9/10

Malware Config

Signatures

  • Renames multiple (4505) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\672b7133a313afd9ec5178569a8bb170N.exe
    "C:\Users\Admin\AppData\Local\Temp\672b7133a313afd9ec5178569a8bb170N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1092
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4328,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
    1⤵
      PID:5000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

      Filesize

      75KB

      MD5

      1ada9ae80d9ba6d664a1684fcdc20132

      SHA1

      aa3b72fb24a1b3362fb3c6ccce323c7796ea5563

      SHA256

      ecf8a3c82dd2379c24e29d6cc6fe09e1a922eab07da6930b58419e8642203939

      SHA512

      6a62f6da95a219df1b98335cbfffc9576a447e24abed1072e7caec9d7fbe98abb730062d3b99469067ddd65466e93af605098a7ffc48e6323f503f2f791f5ebb

    • C:\Program Files\7-Zip\7-zip.chm.tmp

      Filesize

      187KB

      MD5

      4912b5c59308aceaf7b9d2f7b33bf144

      SHA1

      451f84f5d2d9968f54ace7c9a3a0b2c8e1075704

      SHA256

      d8720dfe9538144d70913ee3b1745802d7c90445a7d3ae07d800d7f915f80974

      SHA512

      c2a5b2eaff5c6964c0d33f350fcf7bc20fcaa83815567b17e4d47aaa51140f9a3ae8bdeede79f943a06d488331b22d82a593c2f441c210b07602a5b135aefc7b

    • memory/1092-0-0x0000000000400000-0x0000000000408000-memory.dmp

      Filesize

      32KB

    • memory/1092-810-0x0000000000400000-0x0000000000408000-memory.dmp

      Filesize

      32KB