Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 05:26

General

  • Target

    962326e9cf6a407fc616275e56657060N.exe

  • Size

    47KB

  • MD5

    962326e9cf6a407fc616275e56657060

  • SHA1

    ae16c487940c810b08aed1fba0f9c038af0de952

  • SHA256

    f1a6f093b57b6e96d5ff815980b26b57498143f72e761a3c324afad9d012d5d0

  • SHA512

    0633a2e6b61fff4a9eda958c5a704f7b449525fb023420abb0381bca83435af7ca44bdbd7ae8a4ed7be5a6a9256cd68d6fbfed92b9511b17f44572d5145d3473

  • SSDEEP

    768:/7BlpQpARFbhNIiJwsJwwnZEQoVeDQoVex:/7ZQpAplJwsJwwnlYl

Score
9/10

Malware Config

Signatures

  • Renames multiple (4652) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\962326e9cf6a407fc616275e56657060N.exe
    "C:\Users\Admin\AppData\Local\Temp\962326e9cf6a407fc616275e56657060N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

    Filesize

    48KB

    MD5

    e05fbfaaa5375b78d1e740fbbf4b0048

    SHA1

    31497781ad0167d7a800f1a615dd25ec27ac7ea7

    SHA256

    24394c6790a6c1e4895819d25d6383f69f2a3cdcd009c86dafdbbd7831dc4b09

    SHA512

    69fc6672193d7971017c435c35be609ef621ac066b1ea7923cd02dd862e791b3db6362ba3d34ecb5fcb37dff4626d1e833ec77b3209a45ac7f82ac7623353324

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    146KB

    MD5

    ff24e69f88cec60a62ad5f9475b43d21

    SHA1

    511af2d022a2bc64d173828082a2cf203503aa03

    SHA256

    c608ed0bdef72f8737680a9a6b09b83258439f2460582b98bcddbb65c62097eb

    SHA512

    91771695e39fef7ad4debc88aac71d835c6a39df9b8a0c701a420b66bcc7789129cbc9b231ad2dd479112e102986771b9fce4c5571eb9113f73acb72be9e3bac

  • memory/3064-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3064-860-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB