Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 18:22

General

  • Target

    16dff8bc7961e4b6a64cec93fcb80540N.exe

  • Size

    33KB

  • MD5

    16dff8bc7961e4b6a64cec93fcb80540

  • SHA1

    87a5c36bf285ed1bf30a3533256572bc56239e06

  • SHA256

    3f592f5fb10f63081efcb866540f9f1e9d5db254f77f7b8c03fecf0f36edafaf

  • SHA512

    5247296bb9b08d3fd2fac17dd57a4eb786a74152b6ffc6766a729900af089149c56c30b334c38b464c52eaa38aae7ca9c3ed38c117d472c3af0ad2063d472146

  • SSDEEP

    384:QOlIBXDaU7CPKK0TIhfJJPbUSzsOVCjT+:kBT37CPKKdJJTUNOQT+

Malware Config

Signatures

  • Renames multiple (4649) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\16dff8bc7961e4b6a64cec93fcb80540N.exe
    "C:\Users\Admin\AppData\Local\Temp\16dff8bc7961e4b6a64cec93fcb80540N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

    Filesize

    34KB

    MD5

    f2767e91f97cce54ff883c85f5b1931e

    SHA1

    16372231fdb1a75673ba93266e70d8ae06cbe7d1

    SHA256

    872b04d94d65b27f526efb66b59b6fb6c6c96d34feb39525798877b3d38d052a

    SHA512

    a347711aeb25bd813fbfb8aee326ce07cabefe55a30f1bf43fd95e416c1efd4b241e8a427ae49c09f1db3375499e773857490ed6cc0f3128bf801aedc139dedf

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    132KB

    MD5

    e170b1405c334944b40d4268c5fd5f65

    SHA1

    2007ad3bc293a0ed58b797a67046ab4f6ebe1b6d

    SHA256

    87a9f768cdf8d8a329cdaa0f7ced83d49853fddd87a13fa8350fa45c85eda5bd

    SHA512

    fe7d4f402aea7e2982b47f9aacb079e385619bf9120af8a294107a234f74f1707389c5823d106adcfebeafd45609128a2477288c9c89906f0a7dcbe370dd2695

  • memory/2020-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2020-855-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB