Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 11:44

General

  • Target

    55aa33456cfa8107c23b8a6905e1f6f0N.exe

  • Size

    35KB

  • MD5

    55aa33456cfa8107c23b8a6905e1f6f0

  • SHA1

    134ad427cd5989007cb61f176164f9da6c9bb7ba

  • SHA256

    948a0dd824a5946e7e4038ef5368fa0ee0b1f9130ec80e4d3737494038f8f905

  • SHA512

    1281ea12bf9fec4d6deb4475ad4444b2482909fdb99f1fb9d4a676f529f937156bded090340ab227026daf57c13c22c6c258d6d1d995d8afff0a475c2a34ba1f

  • SSDEEP

    768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mF09Ub9ULa+az:CTW7JJZENTNyl2Sm0mSWbWLa+az

Malware Config

Signatures

  • Renames multiple (4645) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\55aa33456cfa8107c23b8a6905e1f6f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\55aa33456cfa8107c23b8a6905e1f6f0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

    Filesize

    36KB

    MD5

    f7e50c664e4bb05772089914662ca033

    SHA1

    9ce84a4e6536bb168282410d0db83395e479b736

    SHA256

    81ac3a87e7404433856d66ed3af594b8716e96f38fbb5e1dd17f040ee5701f45

    SHA512

    4aaf93b6361feab453a41d845644b0da8e4f6db38d0a31247c2b17e772e9ac0e7b4ca844072f503d78603fde61f0c33e02d4ccc8890c8f350050d1d488b897bd

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    135KB

    MD5

    3a16638f41f89e95a929aeba8dd4f8bf

    SHA1

    40f92f6d4e2b61ba2904af685e2ef27adf4731f4

    SHA256

    bb57c865d0ac873017c654ad807361c7fab7e657529a4b45ee17a47e9ca3ff9c

    SHA512

    01465f93bce97af8f807884dc2af3866aacda20a9dc18986be7e415449c48844539986c3493354928e82c720e17d850c297fc56ecb06a6d3380a3282328cf5ca

  • memory/2296-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2296-901-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB