Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 17:27

General

  • Target

    6f3f88a300ff657cc48332b20f2c8970N.exe

  • Size

    85KB

  • MD5

    6f3f88a300ff657cc48332b20f2c8970

  • SHA1

    eaa7298f035ff07e1d0660b8ed231ddc3a00acd6

  • SHA256

    5e0706af1d81dd7b1c478e2c7e2864354eebb32701b92f087a337746bca8778b

  • SHA512

    a2d21faea77df5a1471a6e3eeb13d6fcbfec391d482d1dd1877b5b49d726009c06625f1c4578291fcbe3bc8fea0166c5243525be05318fae671a1e0a5c4399ec

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxQiKJAWJA0:fnyiQSoP

Malware Config

Signatures

  • Renames multiple (4616) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f3f88a300ff657cc48332b20f2c8970N.exe
    "C:\Users\Admin\AppData\Local\Temp\6f3f88a300ff657cc48332b20f2c8970N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

    Filesize

    85KB

    MD5

    7b4ca177bf474f4511fb3f15ca30a7bc

    SHA1

    fd6b6f237fcfa57ec5ba7de5c78315b73dad85f6

    SHA256

    07ad9cec2e8e863d1d768fcc5915d2ea35f5e8b0734458ef057c47030b9c4b43

    SHA512

    055f633e7ab73fe1976b4b2ce3caa536816eb44fdb64108365dc7e909c3dd6eb7fa5b458ff452922fcfdaa1ccf57ec1a794bccd2ebb821dec3390bcebdbc36f5

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    184KB

    MD5

    1c26ec0cee35d2cfb9857c516ad5720e

    SHA1

    e3fe9e202db695e55b0b1ae2a363a51ed2d8c658

    SHA256

    a62696b299eb55213f94635817858a60f1f5b2bceda9d5818c0a11b9a980a134

    SHA512

    fe137a02df13509d0e74d61d6efb84d1911e0a9514632c1c38eb7da744b5d10d992154ceb68a9b82ec8d91f2a210c48da98d639c70afac8603ae86fe8903e2fa

  • memory/3384-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3384-798-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB