Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/08/2024, 21:23

General

  • Target

    4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe

  • Size

    59KB

  • MD5

    48ea42b166f71770be1c96f027276bd0

  • SHA1

    70616c8217000cfc49d79f9d45b63d2abb6092f0

  • SHA256

    4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09

  • SHA512

    56a5d950f6a42308365b8666220ee6dc1c6e4ef0e95727b49daa09366a758163a61e7a1a91f3f50b0f3ed073e5b583e7639521f090640cd6df196700cd5d6758

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9nj40g40z:V7Zf/FAxTWoJJ7TJLgLz

Malware Config

Signatures

  • Renames multiple (5164) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
    "C:\Users\Admin\AppData\Local\Temp\4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

    Filesize

    59KB

    MD5

    a969917cea530f7ff827b1152ae4bdbf

    SHA1

    f1e62c4f7654d2c97ea252310e8861fb4048c82c

    SHA256

    d5d028fa3a7ee6e71e95eaf24ff04e6944872028930f1ca6694962e46693d525

    SHA512

    96b1d8dce5dc0531ebdbeb7536c59e4aed6b47428ff6210673949dc8d0f27c472686b53fb6914f6c0c2f98ac03e7109534d4dd27e85ff900bcf961fd52bdbd3b

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    158KB

    MD5

    d860797d44de73a777facbd75d719f00

    SHA1

    33ff83692ccc0997dae0c41a1fb07020c0ff93ed

    SHA256

    e8b196bc2f821bbfbf94f009ce4c407f54ee8b5dc90b7f4f97cec4b065509e88

    SHA512

    b833617caca17bee8abb18370412148fa2385485decb265c184fe8f95c7d22a77f8717867b36c04f9f54b3e3fc9540a8fae9f07b2fe71629c6c83e265b948d81

  • memory/4416-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4416-846-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB