Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 14:53

General

  • Target

    9afd6808c05514f158a9ca78d653a150N.exe

  • Size

    50KB

  • MD5

    9afd6808c05514f158a9ca78d653a150

  • SHA1

    7ce5b5b91b49d22008a38ba576c19ba52e538807

  • SHA256

    8336166f39a76ddf04182b003b78955047b80d5e17d105379fa4022c8db1b42e

  • SHA512

    2e5eed177ee2ca8582d35c65f297b1864eca044bf5399ada8bc093aed31611f5884f30865698e6fc160a8e8c8f790cda164dd11500c1644be7de8107798f71b2

  • SSDEEP

    768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyfxAkJhxAkJ/1PQurQmi1x7urQmi1xY:W7ZppApyVyjVyUosPosk

Score
9/10

Malware Config

Signatures

  • Renames multiple (4596) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9afd6808c05514f158a9ca78d653a150N.exe
    "C:\Users\Admin\AppData\Local\Temp\9afd6808c05514f158a9ca78d653a150N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

    Filesize

    50KB

    MD5

    9efb12f9d949c099ec273a17947dec2f

    SHA1

    676b5610df1bdceaa1eecc858eb98ff978c17ab5

    SHA256

    aee81bb781d6d25e654db78a99f8c6bc27cedeaebcea3715def0cea42a9bf1a4

    SHA512

    8401bf25d47fad3a4833d16a247b897a63b207383aa22cb00cf4e49229ef0d7bfb28ad5aef556f10bbafdd62127d5f401ae2ced1ba46bca14aa1ed02362b750f

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    149KB

    MD5

    e27ebac2dec2539ee0598d1070b0703b

    SHA1

    a76bf5dd1b9656299109caa4d0bdd1f37a6030d8

    SHA256

    847533e1be92389c589fd7b3fd13534c5d3e849b2fdc9e7a97f1894d10a3b933

    SHA512

    8a99763f4ff553dfc0b7c938697aa0b5f7172fd5f4d7d4f03963a64cf9fa8136550c5da685015ccbd178d8ad55677c969455ed1d77d9635b014f3ae1edd7f7c4