Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    85s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 02:38

General

  • Target

    c959a7e308ada6f75b279eb50751b630N.exe

  • Size

    93KB

  • MD5

    c959a7e308ada6f75b279eb50751b630

  • SHA1

    73537cf75d6ef03ff18e45c934898b1b4946ffec

  • SHA256

    485b9322eddcf5126c18b36d137e036b9af10f121d46b73c665c24190422196d

  • SHA512

    8ebea463ffd4fbfbf070bdf8abaa183f6b594bca8a96a48a6f2e6a0463fd93747eb99391182994065a72afca69e80f2612ba76019badd76a3e456476ec31a7ad

  • SSDEEP

    1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOMETC+cI2IPQ/hQ/Yhl:6e7WpXYvnh3I

Score
9/10

Malware Config

Signatures

  • Renames multiple (4608) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c959a7e308ada6f75b279eb50751b630N.exe
    "C:\Users\Admin\AppData\Local\Temp\c959a7e308ada6f75b279eb50751b630N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

    Filesize

    93KB

    MD5

    89cd929d1616c06f10eda39f38e0993e

    SHA1

    f9ac156ef550d8adab484d56113b3afa9db6e302

    SHA256

    b21a56b1ec7853cd89f1e621b49550dbbe8ce55d250b001d5c157f92d25533ba

    SHA512

    d0b6ee7bf7ffbedb729e4333ba29a6c2b050aa235934ce4006673c2ac24fb2ebd0c3f7d5395c6ba537e59500998d5ea330ca9a455082c074d03ccd8b5ca83859

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    192KB

    MD5

    8c0a61e60f472ebe4ab1670ef8217a36

    SHA1

    0d405678a75359d7083f90dd9df2de70b2ec9989

    SHA256

    e25701da0a8c8ee097132041f040f0c1df7fb420cdac68b48ed05c38a719eca0

    SHA512

    5d190e98cd0ff5313182f33c4cfb21a4720d04da37b17490637b7badcfb63a6131d8dd4296b11c1ffa9cfaa876deba43a2969c4b02b3da757a4585333c17895c