Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 20:23

General

  • Target

    254b2a2fe938ae134a4761043f1b13c58ff943cc14a1b02cdd6564dde5b8e334.exe

  • Size

    62KB

  • MD5

    53d5b754a3cf1743b1383aecedb6b300

  • SHA1

    84ed04b42b1a4a29cbd6d38578fc4d945af9c8c3

  • SHA256

    254b2a2fe938ae134a4761043f1b13c58ff943cc14a1b02cdd6564dde5b8e334

  • SHA512

    218b33c424c8aa31df8d3bdb077d3ce823655be848b0970ebfebfeb6b7e2719d8d4ec53f0043197605aa37dbf6d3bdea8ddf52238088e79a18fbd414fd2b7116

  • SSDEEP

    1536:W7ZppApBULcfpHLcfpyDMJNnyGJNnyIypCypq:6pWpBwchcwDNZq

Score
9/10

Malware Config

Signatures

  • Renames multiple (5026) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\254b2a2fe938ae134a4761043f1b13c58ff943cc14a1b02cdd6564dde5b8e334.exe
    "C:\Users\Admin\AppData\Local\Temp\254b2a2fe938ae134a4761043f1b13c58ff943cc14a1b02cdd6564dde5b8e334.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

    Filesize

    63KB

    MD5

    ef257614b2e1e24d3931f61e21b8931d

    SHA1

    ba8bae969dbf0c335c8e438e869a21b9de03ec3a

    SHA256

    99b6d69454ad8c8b9504d505e6da770c13fc5a8699b300c4865b1fbb79d4f2be

    SHA512

    4bf9074f1aef6f3e57088f731f6ac01cd1de31babf396b251cd0d4f6341be5e84c1a1c22e43f79899948b7f35ec9b6f55dcbcbf5b6f4d88a07529ca67726c1a2

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    161KB

    MD5

    514cfbd08670669ecf0a04da54fbd7d4

    SHA1

    a96adb26a822dced517d00c1f33e6bf31e90c0a3

    SHA256

    dab598af942c8c20a796fd53de36052298f176105bf586633619f618b0d030fe

    SHA512

    2907bb744db0bf5fe56170e79f6767e4591c84a56c226541b69b9339c5006a47fa21ab71929ac8c3fd6e1341bd099d1a022b97fe5baadee0b09ffe9565fa75df