Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 06:57

General

  • Target

    a765590f8485e653819d8e0832b1fc90N.exe

  • Size

    54KB

  • MD5

    a765590f8485e653819d8e0832b1fc90

  • SHA1

    2cfad5d0fb72e190b59752351daca2670a596b97

  • SHA256

    d32848fc09fb814245e327e4d417904ca4b5ae7b666e3ff05aaf2fd384de9d54

  • SHA512

    61a25cf71bac2fcf91410c540e795fae78b6e962efa3e44c2fe96dc36208dbcee3495b9652900345d4ba27af0443bcac0437ef62d532605419838b30b664b3bb

  • SSDEEP

    768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNy2/mepYXwILQ7ZVnEbisFhiXFhari:CTW7JJZENTNyavf73tQqarjry

Malware Config

Signatures

  • Renames multiple (4528) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a765590f8485e653819d8e0832b1fc90N.exe
    "C:\Users\Admin\AppData\Local\Temp\a765590f8485e653819d8e0832b1fc90N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

    Filesize

    54KB

    MD5

    1c390cf7b875950a9bb605030d190fcb

    SHA1

    7661c7dbbc3df41c90ddb5588846968dbf6ec362

    SHA256

    ff3f9c8d86f9fd655ca1bfc7328358a1cca282f5f5485bd07c1d6faf99a18f25

    SHA512

    2d8c9f92142e8f8ea34b01596b0ab7af32839f2e2be3bbbeb61b8d500c9ffcf7c7062069606d3ff20a881102038afee6436361c684c9e693dc4af05fc3e07ed1

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    153KB

    MD5

    ec3db00542d3a439185ad9967ab956e1

    SHA1

    c3de409be6a8d9fbdc3d6abc027ea4fc975b69f1

    SHA256

    116effe604896b3cd5f15bcc578a3fc7bd8e38d0fb4136754deee07fb01accc8

    SHA512

    c10ae89c6bb69f765e39887cc0760600b47aee925c28a5f341d9663dadf1bbb32600fe2e6c35cf339887a97a68958bcb5bf4dbb12d4f058b7d874572f97e1edb

  • memory/2444-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2444-802-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB