Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/09/2024, 10:52

General

  • Target

    77a0d9c8ac29df3229cbaa9738f77340N.exe

  • Size

    80KB

  • MD5

    77a0d9c8ac29df3229cbaa9738f77340

  • SHA1

    e120df75e837a84a532af69162306968c22a1ea7

  • SHA256

    08f7a84b4bfb8ebb081e5bc2a98fd3610e7e01ad6d0e3cb13e6536632e636508

  • SHA512

    dce5e7aa2a97df7cafdf56ba230fafadf75334eabd27d7fcc1a2a5189a73c87cc4745a473b9d89a04eeb392d0dacdf4e97fca5d9067ebb7033a7cd25b9a30ad2

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTj:fnyiQSo7ZP

Malware Config

Signatures

  • Renames multiple (4372) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\77a0d9c8ac29df3229cbaa9738f77340N.exe
    "C:\Users\Admin\AppData\Local\Temp\77a0d9c8ac29df3229cbaa9738f77340N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

    Filesize

    80KB

    MD5

    dc422220f4c35b7e90dcaaca9c483036

    SHA1

    39824f97a2d1b4e62aaea4b97ce30e1805443133

    SHA256

    d908669bda5b183f2eaff34568ef3c65c185202f74a829abfef6597c04839d0e

    SHA512

    838f5a0dcd132f9655d26e476e31865c03cdd8ebca038f6561e6f7131fcb5d47765b4b3c6621f996e436c81c68bb8011adcdd5af17be0c930ac93c6e48dcce55

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    179KB

    MD5

    460411a74790d123ed102b10598b5316

    SHA1

    725b752fc825e068993c6feef71b8d959e6cd798

    SHA256

    a65e2c750ab7b7a7803c820c0ef25bb2735fc9c0fe7c69e90718891f39b7fa80

    SHA512

    6d9417177edc23d879e73e66d08640e0bdf4ed46b26e30d2673858132b71063940048399f55c785be248197de97e8dd04d83893a20e928360a187c1c0d30b1c2

  • memory/1664-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1664-798-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB