Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 20:35

General

  • Target

    9855a3dfb0bc4e12bc83c76aa0b482f0N.exe

  • Size

    54KB

  • MD5

    9855a3dfb0bc4e12bc83c76aa0b482f0

  • SHA1

    7e6f9959698742b173b31af45dfda6e0c5b39103

  • SHA256

    705af9025eef175c5b6eac58ba8e66cf1b91250f083cad8fc52761259b38eab4

  • SHA512

    e051eefb4e02ec91e50124f7788e905f8302e6e7582fd60d64a151fe7b9e57e48dd0c55b54282b6d03d7521580886fed7b5d3a43683f52a86df8ed4bf4a02542

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9DJKGJKTn/bYONYOR:V7Zf/FAxTWoJJ7ThJKGJKz

Malware Config

Signatures

  • Renames multiple (4627) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9855a3dfb0bc4e12bc83c76aa0b482f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\9855a3dfb0bc4e12bc83c76aa0b482f0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

    Filesize

    54KB

    MD5

    3f75e257cad71b4227d16a01ad4d2e54

    SHA1

    46ef80c429ef3108efa8725479740bbe4c891710

    SHA256

    837d2cf98c467d41118f5e4de01918f701d612b2ca3c457dec0001ccf204e66b

    SHA512

    a43d399b6209fd0903b6a8ab78455aa64d231f7e01566645ce02b420953d9b8841f2c4a9652e8b42224c6ca38cafe4eec1802c7c28c929eb4826502253274769

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    153KB

    MD5

    0702a1cdea531d3d45624da125dfb931

    SHA1

    ff1e7a68d1cc36c5ac77781da8db55d771647c97

    SHA256

    5e60198f75984d515b55698ac11ef107ad845cf4cffb4c94ad07d709785a7b6f

    SHA512

    551aeb794cf47abd5af65520685bed69adaae9af6d0abeeb4dde2be6f4e79fc515531d77c9262ec9155a8f7dc7304b7f451e9575330a537c42e81d7236c266f8

  • memory/2936-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2936-828-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB