Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 01:01

General

  • Target

    b92cb55b01e72326bcf4b7ecbf57ca20N.exe

  • Size

    47KB

  • MD5

    b92cb55b01e72326bcf4b7ecbf57ca20

  • SHA1

    4a632d1b9775202cc6a6d06af5ae4b9b9cbe5419

  • SHA256

    bed910c93c060aa5b336a06b7715d2716bcb0060781c3c334869ebe9d1a9fa58

  • SHA512

    b435a285f641e85bf6b5d690f1c5dd6a19871d9007ba53fbbbf7778cc271a7c39e62c7946c719704dd78bc304a2df7c6c0ea761bc3bc1840485b356cb23ce556

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9DJKGJKL:V7Zf/FAxTWoJJ7ThJKGJKL

Malware Config

Signatures

  • Renames multiple (4652) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b92cb55b01e72326bcf4b7ecbf57ca20N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92cb55b01e72326bcf4b7ecbf57ca20N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

    Filesize

    47KB

    MD5

    9cead6945181d2d35a7d4549a2287ef5

    SHA1

    bdb917955a3257a7cf48e87eac9d6c3782909e88

    SHA256

    ed3bdf106aec4d875e81a669f82366a3ca9bdf95c91a23fec29a2d67d58cfc98

    SHA512

    2ba3ef2c64b31d40d8d8a7bc04d0d53d684acbd7b88a8f5a5dd3525b9db0a13ba069bc8dfb8d81e1fd0381d2b4bee6680d49cdec9342dff8cbb3978d409169dd

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    146KB

    MD5

    4db6f48635729d3cff6f04b4bb7a71d3

    SHA1

    a2afdef3b2fa96b3a6f71e0758a852e39c72cf8e

    SHA256

    1e077c5ab9500d4f3f648d1745f68eb955de5e6b22e5a9361e29042078f21711

    SHA512

    a49af1a55694251c6a28c75b34869a7e32385a72c29e413b7d84c63135d858ec2288018522a8d515bff09e03b2b9eac94c6907c649bf5766ff32f78b96bbd3e0

  • memory/2716-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2716-870-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB