Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 03:27

General

  • Target

    8d8356f65f26af41b2bb4a9a44d3c8186f7a6537cb4fb4774815a05fc04a20cf.exe

  • Size

    55KB

  • MD5

    254b590f2e892d668f1bcd3eb0316122

  • SHA1

    97c69410d9885682af94be3f92dcd26a10b6c569

  • SHA256

    8d8356f65f26af41b2bb4a9a44d3c8186f7a6537cb4fb4774815a05fc04a20cf

  • SHA512

    e73260e98c8377eba17e332582445ffabdeaca3272b17c39065fb677650eb5ee04e1f2c6000d686363884d169ae255b9f9a567f9a920338eb3e2217e697aced5

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9ZJW5eiW5ei9:V7Zf/FAxTWoJJ7TzJWDWD9

Malware Config

Signatures

  • Renames multiple (5045) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d8356f65f26af41b2bb4a9a44d3c8186f7a6537cb4fb4774815a05fc04a20cf.exe
    "C:\Users\Admin\AppData\Local\Temp\8d8356f65f26af41b2bb4a9a44d3c8186f7a6537cb4fb4774815a05fc04a20cf.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:5020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

    Filesize

    55KB

    MD5

    807b88dd9861542b7363b98a22bf3516

    SHA1

    3235f4f879975c021b27b93892bedc2d1eb699f8

    SHA256

    6ab57a5c2480c5c20e263dea3fac69c350ff7fc885a1923b6cd3b349d702fb7d

    SHA512

    6c2082d97454f71dc92723b736485f5cf242673226a213d60bfc7c9909ac4aaa2307a4c9e10a13f303c39dbf4c556d54c8429288a90fcb9d8c1c40ea2e5d3305

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    154KB

    MD5

    f47f82141a81f69f90904ec11d4f2e5b

    SHA1

    7d965536c1f7c13e777a23e1da2398eec7019c8f

    SHA256

    8aeae55cc3d7b792e39cefdca174915cd9d59d0a8b2c356d082a7a8a215f3f4b

    SHA512

    d49cc9e624880ed399dd6fc5ed062fb6f35aae653d489006b51e820c34197215f6faa3d37a54b3cffc8eefffb18f670b7c2959ae95dbceb4deb58c0c23ee84c4

  • memory/5020-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/5020-920-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB