Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 07:20

General

  • Target

    ba3c16561b9c967b4f44380dfd8795a0N.exe

  • Size

    39KB

  • MD5

    ba3c16561b9c967b4f44380dfd8795a0

  • SHA1

    dcf9ef12fbb388543ae09fc2259eea64f878c1d3

  • SHA256

    ed6b488515c0c27c4cf2a255c038754ee058ff912c0d5112c71ee12b88661ed3

  • SHA512

    6f7a52ade6b72e0352eec651f60ed141a18fb55f54a76df9c7dc4eaaa2b6e65b1f832b7b51aea567c13972a93fb650f4800a081aa4aadb0882f139589f2b5e76

  • SSDEEP

    768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSn:W7ZhA7pApM21LOA1LOl6vSn

Score
9/10

Malware Config

Signatures

  • Renames multiple (4652) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba3c16561b9c967b4f44380dfd8795a0N.exe
    "C:\Users\Admin\AppData\Local\Temp\ba3c16561b9c967b4f44380dfd8795a0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

    Filesize

    40KB

    MD5

    5f7fa94a3cccb0ee90b3d96408a4f768

    SHA1

    e09ed115b003107ed1147c9891dd2a1ae4ec16ad

    SHA256

    38c775808cda5f8d0f47333a3c58e8cc31010b0cce67fd6a1b7e495bf72bec46

    SHA512

    5884a60c284e3df6304e8538d79988fcd7025c458bba3b9866db579943791e68246c78c5f2023eeba5551dd89b64e9484dd62841d80e9ed60e08df87f8c18335

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    138KB

    MD5

    c1e6120e1e4ea3bbe5c7db6b2e36154d

    SHA1

    ee202e9a4108e734624ea4b64245aa6b39e2db17

    SHA256

    e4774d27e52dc094d2611fea655b806ffa436dead807a20d50a5c806a7598a37

    SHA512

    c2c7017b2742c26836698adfc27c96d176da55d1843760fe91a1cbe1328fdeda4a1a42ae606af7d7697cb689299130824d710fa6598fda7c61895928af249ee4