Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 12:10

General

  • Target

    1c0263a1f9f39bb838c28dc8d55a9b30N.exe

  • Size

    55KB

  • MD5

    1c0263a1f9f39bb838c28dc8d55a9b30

  • SHA1

    fbcef63b65215da6524a9c3c9c6a083098aa3a78

  • SHA256

    0d3b08f3eed076b0082c9d4963ef0cda4ce0ea8018fc9db3cb5fd2e8ae566f98

  • SHA512

    5c8a13940b8604563d0e2e37e3fa7874e3f6287ed2256d86fb5f7a20a5df85dfa579fb11e1e0275f581c36aee388bc66add6d85932c7f2e37d3847f638562945

  • SSDEEP

    1536:W7ZhA7pApM21LOA1LO2c6b25gc6b25uCrbpSvr5UNW:6e7WpMgLOiLO2c6b25gc6b25u

Score
9/10

Malware Config

Signatures

  • Renames multiple (4664) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c0263a1f9f39bb838c28dc8d55a9b30N.exe
    "C:\Users\Admin\AppData\Local\Temp\1c0263a1f9f39bb838c28dc8d55a9b30N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

    Filesize

    55KB

    MD5

    35102e2fc3aa0b368119e6558da03b81

    SHA1

    08faeb2fed026569992b5b1a7da60974bf2433b8

    SHA256

    f24805c903a5a6f8219bf43a934d0215f815a973e34b77b75adcb3eef766a4aa

    SHA512

    07ce312349ddfb4c37bad307cdc92e5cf8354816540eed059302b42e1f7fa4d13e60cc7bc5cb65b8cf2a6f1c067df41e28a2a926d8af5d93249adfb738ec3474

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    154KB

    MD5

    3f0d6032739c02128b7a9ab8d966dd4e

    SHA1

    23972dbf91d0205df4aa847ea2622c081126c7d6

    SHA256

    480ab24aabc306dad845bf7c5b4986f3e7bc2bac6f7acc9f6942cacb9a2bb62c

    SHA512

    66081e10dd88cfe7220386ec297505409cb7eb66a5dd41de159e55ee13b132132be976c337770e35e773f400838d998acb1d4aff8066d52b4e61f7cd6ffc829d