Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 21:23

General

  • Target

    1908e6a381f4cb24aead7ab8f76567e0N.exe

  • Size

    35KB

  • MD5

    1908e6a381f4cb24aead7ab8f76567e0

  • SHA1

    0e0f2399cb56797c04ec5fe281c6d605b7883a64

  • SHA256

    1ca874f0f1b6a451777e342b1376e64d84e2a6f794ce6a7401f05b52db57c067

  • SHA512

    1ba3cb4664ddb6bf72404838a1d67349a51c93bc06f22de890208eb449e7af163da117d7d6694e494a8773c84b6ea53670d146cfc4e5ac54c490cb661ed99d96

  • SSDEEP

    384:GBt7Br5xjLfAgA71FbhvtPci1lnYOzlnYO5+vu+vn:W7BlpDpARFbhzbYONYOktP

Score
9/10

Malware Config

Signatures

  • Renames multiple (4640) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1908e6a381f4cb24aead7ab8f76567e0N.exe
    "C:\Users\Admin\AppData\Local\Temp\1908e6a381f4cb24aead7ab8f76567e0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

    Filesize

    35KB

    MD5

    d34570116e2a504d6ebe18de7dbd7a6f

    SHA1

    d2f840489c5253a437e85ce192d8595eb3224849

    SHA256

    e5218471a79f60b93fc3467d1dad3c25f27b69fcfcfcbce7581e0f55f62a772b

    SHA512

    e39fd01f1291406417316cf3181f3f5e82aeab2b8f521555da23298acc47cb600aaa3af7c0f37e5632d6dddc5af5053eeb9a6b5309a4cf9c070291daf8679221

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    134KB

    MD5

    c3b9ea6c99b8a0971e4bc0d73fef2949

    SHA1

    0cf3b13984e57c50f8312071f079531cc5cfc321

    SHA256

    5972d344e65de0e9fc5b28c8e388f85e89c2e6ebcac5cb8408ff563f2b7fcb03

    SHA512

    ad67db1ed916bf62259cccc72df459e2e488ad0cdf782d67a7abd8a42b5a9b7c727967584b945b974b91dff41eefcefb7bcbb02c8bee48db1f0cf05115cd990b