Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/08/2024, 03:33

General

  • Target

    d32a2804518f8135e79637b77af14cfd1ef213db6497be136a1124de59bae60f.exe

  • Size

    30KB

  • MD5

    3b0279936f4a652d9b7f122053703887

  • SHA1

    410198ded33cc9e64f1fbf8902a9bee462d4c11c

  • SHA256

    d32a2804518f8135e79637b77af14cfd1ef213db6497be136a1124de59bae60f

  • SHA512

    15a9c3a510baeffd01b7f3694fd2af8b42124ac9a2b181e9072c9825b83e11ef511c424759baf64b2264f920e9745940c2843db732215f851f7902b9ab655e89

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJb:CTW7JJ7T4MU

Malware Config

Signatures

  • Renames multiple (5303) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d32a2804518f8135e79637b77af14cfd1ef213db6497be136a1124de59bae60f.exe
    "C:\Users\Admin\AppData\Local\Temp\d32a2804518f8135e79637b77af14cfd1ef213db6497be136a1124de59bae60f.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

    Filesize

    30KB

    MD5

    084a32a6dd12fd36e7597763cb301a52

    SHA1

    2244809fc64744b116d4d3478c87ae4ddc938c70

    SHA256

    607aece5fbaee3b15dd22aba5a349a2e46a801aba1d9dfe3b1ea9b456315cf31

    SHA512

    a6f620b9dfadec34a195709a35fc518b08b6b31561b6170a93a9e0e068b62bf13caa1d0a3f2911570c8ede4244bdb509b227074ecc1b74298ab953494e624a7b

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    129KB

    MD5

    df2b6283203fb639845d37cc42cd33a8

    SHA1

    e17c54bd213abfa7d443a88e663c710d03d28528

    SHA256

    9434b00d03e1146b9bb0497b74550bdbfc77c9e726e00153fda3e8725210296a

    SHA512

    dea9aebf37949a21df54c26903e5a18390971cf005671276e5d4e893ea3a22d201b9b8aa38e5f3f1a0d412715332356b9794dfcb326ac9328c7e53db4a3f9960

  • memory/4020-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/4020-1060-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB