Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 19:29

General

  • Target

    1c63eaf9d4293a3389862a450e455e7f9d1abea7a5863e1ad5b92ee1871be6cb.exe

  • Size

    98KB

  • MD5

    505f29dc70e14f71b90b35b7f1894b80

  • SHA1

    9b742470200413dfcb5cf9796265a315ffb2c4de

  • SHA256

    1c63eaf9d4293a3389862a450e455e7f9d1abea7a5863e1ad5b92ee1871be6cb

  • SHA512

    f24df27e8b826a5ac68c97e8298785e03ee50632d67b772aa5f069102a68d0a716a0e4dedf254ab0bdf89b336fa92dead10d5f92284b569303c2db89f835294c

  • SSDEEP

    3072:6e7WpMaxeb0CYJ97lEYNR73e+eN7HlulD:RqKvb0CYJ973e+eN7HAh

Score
9/10

Malware Config

Signatures

  • Renames multiple (5056) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c63eaf9d4293a3389862a450e455e7f9d1abea7a5863e1ad5b92ee1871be6cb.exe
    "C:\Users\Admin\AppData\Local\Temp\1c63eaf9d4293a3389862a450e455e7f9d1abea7a5863e1ad5b92ee1871be6cb.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

    Filesize

    98KB

    MD5

    a478928afaffd2a7d601e29f8d0759a5

    SHA1

    8a8afd167124099e327e21fdb6aa27e7db9cae9b

    SHA256

    e3e569345be2fbf844f7ba5b0666c936b1655d661d2fe45b20295a71e9ef6a00

    SHA512

    3b9412a7675d9561b03559a60c809bef7f839ca5a298cbfdf6141497444cc4e1287968b78ffc9980122db0cf8ed211b4e78dc6dcecf36fb405aef4348b0777d6

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    197KB

    MD5

    2ac61ce44de364f60887299b1296f52d

    SHA1

    8baf3af4dea561cfcbd8b33288b59be06c313a5d

    SHA256

    97d031d2fe0b0ef012f7f71b30a59dbde5ecda319c1d3daf4060c57c9fad6996

    SHA512

    26cf5702c66899b00e4d5f727bda64a77d8fb0ddf3d569e118c5a32bf8ec3469bca3b307892c614c6ebf991719686e8dce21c984afadd74faec9456f0ce49455