Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 05:25

General

  • Target

    eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe

  • Size

    34KB

  • MD5

    81cd2bd6725ec35ecf079fede8cea375

  • SHA1

    0fd62c2ade96f78729967a265c9e0d3d59319b5f

  • SHA256

    eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c

  • SHA512

    919c478dc0835773e99d180ab743743d6700de80da8246c1411f137efdca767ac31979079d3855532ce77ba1ce3b822c5acbc58e8eca2dc8e8a2d1cc8a288ba5

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9lBT37CPKKiUv:CTW7JJ7TdTWx

Malware Config

Signatures

  • Renames multiple (5329) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe
    "C:\Users\Admin\AppData\Local\Temp\eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

    Filesize

    34KB

    MD5

    5be2c71cd5a7a4bb63735df034e4579e

    SHA1

    f7e3ad5d61fb39390997a65568af5057325411da

    SHA256

    6f5d1b1076ba28ad013d4f1d9c17a74984f2d3279f2fb7c997bd3ab281599bca

    SHA512

    f69dc3d2677634f3cd9fd3c166958d44277afee9a8465b5477ee472b88eced4a39eb91441f5752a041135fbb02b53cbe286372add3573db4a71f40161c7726fb

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    133KB

    MD5

    1e092ddfdae4334d80f9466e8b492702

    SHA1

    c6fb3670563a01cae9dc6272df1ebb24f019bf4a

    SHA256

    b5e794cf2dc155b071ff225d7ed71477ca4f5de8b02c300904de342c76ac79a2

    SHA512

    ef37148a4715146825fe21f4e7f9d6e1f6c1bf0fa40d085b7cdfcce21e0f355b6306994b1e1cce89bdfbb53b72932f799ba60063a9a4d8d59e6b3e4861fd8eca

  • memory/1740-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1740-1007-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB