Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 22:16

General

  • Target

    2f6f759f9a272e51ec222420ff52e1d0N.exe

  • Size

    99KB

  • MD5

    2f6f759f9a272e51ec222420ff52e1d0

  • SHA1

    55bca575823ce5c6cdbc9c9a008fe75e55189c57

  • SHA256

    cc33f7fc1d29542d012f0ea37ad82c4d9229aad60ade9380b23142763af2b664

  • SHA512

    b8425c18e600bcdf23c1c78df5a2f233097684444dc0743a1f3722c1c9f5a4eeb9ebc5a001fdbcbbf7541ca2be428c6a2e619494c50daca3ee87ac539811d93e

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZxJfes9r9CZcZT:fnyiQSo7ZxJdZCZcZT

Malware Config

Signatures

  • Renames multiple (2439) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f6f759f9a272e51ec222420ff52e1d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2f6f759f9a272e51ec222420ff52e1d0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

    Filesize

    99KB

    MD5

    458ab8cb4e058f8b6c1d577c7df304d3

    SHA1

    cdcf2fc0a2308ef811bf49355cc11cea4bdeae26

    SHA256

    fa68183f55b1e59cbdb3506044337c33017bdfc287954018cdcf5f9b0af9733c

    SHA512

    7ba10ced4b3db778a84028cf24b77a724d25c3641e80ccf3a58a729cf1c95a9e545460a7ae16b457d83b80f50d2b16a1cca7a56430bfee4d44e52c4dd60f2879

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    198KB

    MD5

    200f997b0a07406235bfe2315ba0e7ce

    SHA1

    05b1dbad8b29127452e339dcecd2eb79828710e6

    SHA256

    248380840535a89a9e35c85a5e971452b6dbbfe6b2e9f29c3e9e67c3d3bbd955

    SHA512

    3045c28b7f243e066488a4dfebb94719538817c94c4d382f73a669439a3edf80f677d9914b45569d136a8d7c50746a9863972ec0196328e75b3cea99ac171b8d

  • memory/4412-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4412-380-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB