Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 04:44

General

  • Target

    afb1e1d1244e6bc17ac709ee406eb310N.exe

  • Size

    38KB

  • MD5

    afb1e1d1244e6bc17ac709ee406eb310

  • SHA1

    501657d64f890087a6d4a153d8df1281608fd7e2

  • SHA256

    ead8be57c4955cde1559e1dd09aa44461256164bad8496203358bfeb5e4ff169

  • SHA512

    385a0fc7bda5f10be9e93bd3582cbaa6057427aa28db947714655ce3f03426dd653d527b27d0adf68c6daf1b48ca508c3e1a9c6cf4d24ff82e18f0fbfc40165d

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42LcfproFNF9:W7ZppApBULcfpHLcfpyD9

Score
9/10

Malware Config

Signatures

  • Renames multiple (4673) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\afb1e1d1244e6bc17ac709ee406eb310N.exe
    "C:\Users\Admin\AppData\Local\Temp\afb1e1d1244e6bc17ac709ee406eb310N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

    Filesize

    38KB

    MD5

    8b7f17dc7999383b59cbd2f562b9d392

    SHA1

    ca0ba36ba56d16b8c5355ec6ba87d54aa538dacf

    SHA256

    d3ab71b0c20600a1aad5ae827559df777c9f35c2b1e7ed8f60ae467c477b2d40

    SHA512

    3c5e301fdda07766b301890a8e271f87fb17f5ef4bce46f81881b7d56c2dcebb18feb815a177e7829e3674679641492c9fbb41a79ec350f0309a7c7dcc07e1a2

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    137KB

    MD5

    4171af0822f90d7ecd380448a978ee42

    SHA1

    86931f43d98501fa0748485880367377e6e57c8b

    SHA256

    a3f9af8c6a30672b410094e6b0d061c77a17389bdc8badb71a57be554cd23da9

    SHA512

    3ed6b8f1cf2057b8e58879f1ec8f5b44da24c3f73c0f772fe9a5dba855047a4d67d3c49d38901959c62627a87a6cb56dcd080c42678eaa4df10e7d6ae91e3d15