Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 01:12

General

  • Target

    cb20a9437a9b68af88de6d7b193cf8f0N.exe

  • Size

    55KB

  • MD5

    cb20a9437a9b68af88de6d7b193cf8f0

  • SHA1

    2a99bf191cea02e57aa88e4fe73732cce8702bac

  • SHA256

    daa168d4bf18b57821fd1e511fb9b38e3ed40865c768136f0ea2e08dc32aba3b

  • SHA512

    bd383dacbb43c4a4e880ffd0948b280c91d6d90561d3bfa85f7c8e8e2ef1b79719bad10a6f68844e146be0779c1afbda016b1e5f6f2beb16e1a5b9a1c0ce1211

  • SSDEEP

    1536:W7ZppApBULcfpHLcfpyDDnTxASYnTxASshPWC1:6pWpBwchcwDDnTxASYnTxASeT

Score
9/10

Malware Config

Signatures

  • Renames multiple (4618) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb20a9437a9b68af88de6d7b193cf8f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\cb20a9437a9b68af88de6d7b193cf8f0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

    Filesize

    55KB

    MD5

    6aa873bc8e1c1cc5cc4c03c2e22e064b

    SHA1

    0ac0a20734ecd78a869d9a5480ae5dd07933f701

    SHA256

    ddf796e02d5231340c35114f5efdfc11204c75f19ec7507e340e51d459faa93c

    SHA512

    bf85e195be79562836840825e8479b399c21fdff834bcb7961a81ff4fb3b4cd1585be59a49fe141d819c341288139d96ffe13e47e309f1fb7afa76fe75eb2909

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    154KB

    MD5

    0431daca1a0d36eb226fcf1e900f795c

    SHA1

    995a5acad2f9b5d3383a2843976705eb193aa5a4

    SHA256

    37f191f6f036527dd7507260999adb7142d1320fdfb34d4cf984a746461b7308

    SHA512

    53f97378f2c4c5109a172f508121928a3db8f46bcfcc7e118a33418c1f406d43877eea245747aa3b864b32785417d10bfb92caf59cd7809599b1d6dbbf8fba22