Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/09/2024, 01:01

General

  • Target

    fb8e850a1e520c79c12e30ab183f1870N.exe

  • Size

    129KB

  • MD5

    fb8e850a1e520c79c12e30ab183f1870

  • SHA1

    688b600d6f8da4a85a28ab29ad035b36a49291fc

  • SHA256

    5e8a415aa6fd51b42dbb073559b64d213c223dd080e06efffa8779a2311b2b78

  • SHA512

    5200eb4fc9e02c47e4f496a6fb786527e6cbb739f318fea808d42fb6a7a1795b5a1e755f17ce90634b70f8ade8843d3255e9d848af4f11f36408a46c510a7f59

  • SSDEEP

    1536:V7Zf/FAxTWoJJZENTBWv36DidAz9gmHXwDNn5e24sPP4FmIFOTpWqhVAqKVxmq:fny1tEevW4ABKeCPwFmnpWqhVAqKVxb

Malware Config

Signatures

  • Renames multiple (4367) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb8e850a1e520c79c12e30ab183f1870N.exe
    "C:\Users\Admin\AppData\Local\Temp\fb8e850a1e520c79c12e30ab183f1870N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

    Filesize

    130KB

    MD5

    7d86ab1e706edda5f612ccf5215db767

    SHA1

    e13dc86e5dc63f18d1640570ffd25901a87723db

    SHA256

    fb0d30a5266a5fb41c6923b3655e7a2cd6e315a981fec438c1f6a4a53e2173ec

    SHA512

    c1f1f6251659eddf4394313d4944cf768a155e7dfa3d1253b4b5555c646dd124bf7114eac02e8646f7166de0459e0f203e185cccb4de8344f7732d3910eb7f7c

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    228KB

    MD5

    388a25676b610f7ffb59063dce608329

    SHA1

    307144aaed74b373fbbb645bf52b369d0c7eb215

    SHA256

    0a6febbec6ce31b7f378343d8c3573f61a7982bf25ce8f41c50642b75ddd5b03

    SHA512

    d8b88dd251ec0957f22c42378e8ec740b5e1fb3a609058a8b18e5d9823c6fe2bd6900cd292db7ea9f9551b7e851a10a8c7bdef3cc265eecf40620e75bd3321f8

  • memory/1032-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1032-852-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB