Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 15:09

General

  • Target

    0d453e6b496a4b0423ca3dfe35f8db30N.exe

  • Size

    82KB

  • MD5

    0d453e6b496a4b0423ca3dfe35f8db30

  • SHA1

    467efd3743fb01cb289051a7832561a4ab7d9f26

  • SHA256

    2519c07529058d148aae53c7baea8980c1805f51cbc5c541f1c799fc9f0061c0

  • SHA512

    0c697fd1e43d1d798e27f61f9b69b511307b71ff2e43756f5088dea2d99eabc0dc48ff8f263f6a173e7e29aa671de2120a7b51af4921b5be3322fa5c955ae63f

  • SSDEEP

    1536:W7ZDpApYbWjIoPyPoLzV7c6ShWfxRfxC2R2f:6DWpLf7fU2R2f

Score
9/10

Malware Config

Signatures

  • Renames multiple (4335) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d453e6b496a4b0423ca3dfe35f8db30N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d453e6b496a4b0423ca3dfe35f8db30N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

    Filesize

    82KB

    MD5

    49036db128b4adac4098441dd6c5576f

    SHA1

    8db71f67691ee8b672fc6c24d3747a5ad7d8f34e

    SHA256

    1b64d68266e380ab254a5adb1a65a9a7e118e690bc646c4f69adc4f4fcf11ac0

    SHA512

    9c1356a0a22bf4cf1eadb34472fbad809351c37bd3d35daafbeb993109d6937436f97cb6fa0e519ed54db3b6fc6e062eec833c4fbed3c73f3b676d30b98967bf

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    181KB

    MD5

    b587d556120be5d92df77b00987cea27

    SHA1

    8fd57bf14d128f175fab87cfaf9fb5d530e43e2c

    SHA256

    f6a339859defd082cccb70d917cb8e29edc872976ccce3e9f5220cb1bc9bccc6

    SHA512

    9f2df1799266c879b9be432de010727d8c6be4c7110a166069c9dfb9c77eb1dc99102da5b173ef609ea4482a764db29e7320c0830de141cd363891033b9c867e