Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 07:12

General

  • Target

    33a4b281d8606e4724f75a4178c8ba30N.exe

  • Size

    108KB

  • MD5

    33a4b281d8606e4724f75a4178c8ba30

  • SHA1

    ba18d71540c3480dded99b22c59e9285b6498d8d

  • SHA256

    38cfb585512705551275cef8e8d0b1eb25b270c9e2ea721d357187799209c54b

  • SHA512

    a7469409546752b3ce29cee0cb054055d8d3fbd7a3e8250036861b8d9c58146e719a53b253e46433c2459cff3cd319f81462524264ec08278a359b4aa404c81a

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZf2XcqvcYdnS:fnyiQSo7Zf2XLnS

Malware Config

Signatures

  • Renames multiple (4378) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\33a4b281d8606e4724f75a4178c8ba30N.exe
    "C:\Users\Admin\AppData\Local\Temp\33a4b281d8606e4724f75a4178c8ba30N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

    Filesize

    109KB

    MD5

    05cc046803c5144e9916db948699de66

    SHA1

    d395bff79d4d677051eeb82b0a43d4c8546c9b83

    SHA256

    b0313d2f63d77f4c0176c87e5f0a4897f3874d9ac8db921d485f3244520603c0

    SHA512

    7bc6ae57750adc247631ee214cf7fca2e85158578a716329d797fa57de7eb242506f07b0b94f4904c4300383e58bc57282439447d943c895c0238bdd2e10ef7e

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    207KB

    MD5

    8dc67f0dc9311549440cfea8c3d4cc60

    SHA1

    a7471dbf04a21c0004d9289100f3b74324d7af1b

    SHA256

    48bb0bc9701b5aa5a623f72d369c1753011e1de8a0e1e66d439bd51522e1cebc

    SHA512

    ed41cbdfcad227ffb234c511c9b382b809a5ec1b9272be10cfc80eb523c257b178b96dfb94cbf905fa3b8e0408f5a62d37d2c2f2337e695c3a247ce6f6361f7c

  • memory/1828-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1828-852-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB