Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

a345d47073...c0.exe

windows7-x64

9

a345d47073...c0.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 14:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a345d470738a428a10bf15194748beaa5627c75692d66d1016a01d30bc1cd5c0.exe

  • Size

    371KB

  • MD5

    87d5535c6d94bef127f82f5fff6497bd

  • SHA1

    a83ec32dfb1c590ebfd6e3233d81a0f3cbac0994

  • SHA256

    a345d470738a428a10bf15194748beaa5627c75692d66d1016a01d30bc1cd5c0

  • SHA512

    f37502876aaeaeb7b3e2e842485e7e00c6fcf5206824548970ec011a40f7303d8e48898069f36376dc92165f0652d4d890cc55cf46200af6191dc9598323bf65

  • SSDEEP

    768:CU41Hv11ZX47nelShWFhdEod+QZnpLtx+:81HBoClShWFhdl+QdjQ

Score
9/10
credential_accessdiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Renames multiple (7584) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a345d470738a428a10bf15194748beaa5627c75692d66d1016a01d30bc1cd5c0.exe
    "C:\Users\Admin\AppData\Local\Temp\a345d470738a428a10bf15194748beaa5627c75692d66d1016a01d30bc1cd5c0.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=1MB
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3996
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3808
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=1MB
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3036
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3160
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=1MB
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3104
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3512
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=1MB
      2⤵
      • System Location Discovery: System Language Discovery
      PID:336
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4956
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=1MB
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4404
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5044
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=1MB
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1748
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin Delete Shadows /all /quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\CONTI.txt
    Filesize

    155B

    MD5

    306995d320c5ecaac50548a5ecea7e93

    SHA1

    8e07180d87e8241ccc0a256c09c18a5268742664

    SHA256

    5f048a86adfb08eb5edded7c8592cdc3aad8e50cdf3fe11d3790b5ab1311afee

    SHA512

    f5055877ccda5e0f8dd6e58f39e3ad9aaff4555cab788d72e483e87324bee2985f3defb24fd8e1be8dbd9747be8792f2d8172e946755123b03a270e8d4ea028d

    Download Submit