Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2024, 05:46

General

  • Target

    bdc647a8e11cba7996472b243b9bf990N.exe

  • Size

    78KB

  • MD5

    bdc647a8e11cba7996472b243b9bf990

  • SHA1

    c081f008467539cb9c1f75aea13fdf11b827e506

  • SHA256

    77da85a52831041ecd6b8f6b19f47a8b354e6944bfa6a1b1baeb94b212371dc9

  • SHA512

    34e03ff6e365e31ca798ddac78939d1a82a5aede720b1f47898fee799b08cb0fffe118b9209553fce19b447ee931e511c1f8d91f9ce3c7a6f158f3af5f9da754

  • SSDEEP

    1536:W7ZhA7pApMNcH6gW4Wvs9s2cic8GhGvnQw2w+5vC5v8:6e7WpMNcK9vG1W3w2w62E

Score
9/10

Malware Config

Signatures

  • Renames multiple (4176) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bdc647a8e11cba7996472b243b9bf990N.exe
    "C:\Users\Admin\AppData\Local\Temp\bdc647a8e11cba7996472b243b9bf990N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

    Filesize

    78KB

    MD5

    aea2840896dea0064a7a4c9e59f710e9

    SHA1

    2e2dc6ac3eea4dabb581e4e9ebf2bb443f8bbae8

    SHA256

    26a283a11ccb807b14b663cd82dbc63778af6ab38e4c11d77a9f0f9ccf8cf384

    SHA512

    802617db42a1e54ded2c0649bd0b187930c36df26a2548bd146f6a000b396ff8e5b0af05999fde113cb3c7c7adac95afb3b8187cde04bca518077a46a6a20335

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    177KB

    MD5

    42574063c01875ad7269dec1947e9683

    SHA1

    0b75ede106207bfb75bdc4981d5f73adf4351098

    SHA256

    ddfd7e5d25134b6460a13e323414caab761a32ff87158dfacab431e522f9c922

    SHA512

    fd9b2a8dd3e84dcbbd84c83c0e38e9bedf9da82ebe8d8557001e45dc8809f6c820de52db742407349be73edeb27634c652ef6890ad40d8cf066dc21138e5c5d7