Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 09:17

General

  • Target

    ec65f51dd55ccea3352eb2bf128c3b80N.exe

  • Size

    80KB

  • MD5

    ec65f51dd55ccea3352eb2bf128c3b80

  • SHA1

    556cd90774f5dcf593978901634169daf2878ec8

  • SHA256

    48c61a95953379cee69a02a9dc388a9db20a593ab633d35ff863950d937afa45

  • SHA512

    7c7aa58a702d2a7c048584bd93f7eb35f821f65d86f21f5d9ad77c6e13d7622aee9e76b94430ec34211634e36229f8cd30ca3c14382502c1d2aaa3e066f1ca6c

  • SSDEEP

    1536:/7ZQpApze+eJfFpsJOfFpsJeFrxFrd466:9QWpze+eJfFpsJOfFpsJ0rDrN6

Score
9/10

Malware Config

Signatures

  • Renames multiple (4636) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec65f51dd55ccea3352eb2bf128c3b80N.exe
    "C:\Users\Admin\AppData\Local\Temp\ec65f51dd55ccea3352eb2bf128c3b80N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

    Filesize

    80KB

    MD5

    aed7d9f8dadae7f4a64da58b60b27b3f

    SHA1

    56cb37c14296a7d935c4b87c6d44848075cef98f

    SHA256

    196d5e92fbed00b8b73bcf7ef7a80c8e1542eb0dcb6e4efbe0d79dbaa2b2e7d6

    SHA512

    6d2ee24536ba4ad9bf5d51f6c1e747223c75e285c39ff27f29ec355536cea4ea69d4360d62ab1f9cdda780a173e032f937815d32c8f06882644a165cf60aa7b5

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    179KB

    MD5

    6dc6f5d404337487ef96f38a89f3aa3e

    SHA1

    7113e37a45dfbe6307489b156564f57be36d1387

    SHA256

    b953baa02160022459e8256e9952663c60229acf86d21220874a7a6422aeda37

    SHA512

    597523cf48240040f2c1f9535b19a1c310550776e03500a7a46cec4e9812d1f7cb42ed1b98f8769e4a8fefa90a723e06e5129165d951b5006394029bb663cf3e

  • memory/4840-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4840-860-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB