Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 23:22

General

  • Target

    29a05a7e944077283f353dcf73c99810N.exe

  • Size

    47KB

  • MD5

    29a05a7e944077283f353dcf73c99810

  • SHA1

    ba7b2937d3a96ee764755d089f843a53f1fc8dfb

  • SHA256

    a8a30d9df7a22520dbe7492f9592030da6571c6cacc6b03329f5e7960503cb60

  • SHA512

    b3a79401fde67e85dba627d4d9d9fe7cd0e8da4773a7f173a0990021a4edc6f3a374eba74f015c57b163d398c10bf7df3a1d5b1b903154dcc41b99f45c3ba704

  • SSDEEP

    384:GBt7Br5xjL9AgA71FbhvuNBN10wpAp/lvolGClvolGwTCus7sj0h3MM0h3Mm:W7BlpppARFbhbt7Y7wTCg0hcM0hcm

Score
9/10

Malware Config

Signatures

  • Renames multiple (4649) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\29a05a7e944077283f353dcf73c99810N.exe
    "C:\Users\Admin\AppData\Local\Temp\29a05a7e944077283f353dcf73c99810N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

    Filesize

    47KB

    MD5

    3f92eb4869e6c2bc6514c42db8c5b0d2

    SHA1

    d5351594178ba4508a7c5672e2afb0ae45a38a25

    SHA256

    4b25db2aa885858d5fd17515aa313043b4bc12af6e2ee142c708c636697a7b92

    SHA512

    0f02a1deef2d9f9bca9f5e7423378ad84708df25ec8042f24abd5460ce3f2db7182f178e4c5db85f5714986463fb93828ce5d3a4deed44ddb4a04d49ee543059

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    146KB

    MD5

    7bcc48675a9680e7ba5cfc0505a22877

    SHA1

    5eb2496bdf63543e6d67d5e67385f3681e54b953

    SHA256

    a7009e36b5bfa48abd526bbb6aef32c30fab3bca51e9778eee0af2f6a7f35a2b

    SHA512

    0bbc9c95cc78f67f1003952d132f6c9853780d7aa346765bbff7a4664c03780a182f465eeaa8339a4b3494950dfadf04cdb74eb68d89d43bc9eb86ae7422d16c