Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 01:20

General

  • Target

    bf38a3d7ba1084bca94ee3a423ce27addb6a35428527daa434192a5e435acc68.exe

  • Size

    44KB

  • MD5

    143685922828b76090efd7c974e0590f

  • SHA1

    a408538fa4071b16f2fd7760549ece73da51bdd1

  • SHA256

    bf38a3d7ba1084bca94ee3a423ce27addb6a35428527daa434192a5e435acc68

  • SHA512

    f8a45ee41f2af03a17e8631e037b6c23ff041ce5bd7639bfdacce443c8d5f695a8d9e64f8323019d5c24a4ca4c7a3bdbb8e35adb0caf6ac538ff3117eecbed62

  • SSDEEP

    768:kBT37CPKKdJJTU3U2lRtJfOLP7Pki9Ei9F:CTW7JJTU3UytJfOL7k7Q

Malware Config

Signatures

  • Renames multiple (5199) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf38a3d7ba1084bca94ee3a423ce27addb6a35428527daa434192a5e435acc68.exe
    "C:\Users\Admin\AppData\Local\Temp\bf38a3d7ba1084bca94ee3a423ce27addb6a35428527daa434192a5e435acc68.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

    Filesize

    44KB

    MD5

    3a41b3e8a0026c24685fac0956f9479e

    SHA1

    1c9b2d878ba0177639def3f14ff6bc35dc98c517

    SHA256

    1f6d7bc3a2c8f2cbc85e91c1e3fac396cc84a848878d1b10ea9ac72aa2236845

    SHA512

    4e4fa9da48b7efb23997f99b51ddb9b10f0e81a25f6a9cf8b24147e279be5f3520968dab18ec4839e3b4f230853fa2539cbbeb765c3788b9790e9b4e2845a877

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    143KB

    MD5

    b596a1ef954e0dbde7722783ed1bf437

    SHA1

    57cbbd41491d6323606553882b6d9012c60d2edf

    SHA256

    bb226225690584906896c8d811944ee161d0798050e26b9e81b5d2f3325b1103

    SHA512

    b1c7f9eb1392aec26ffae24d7886f306e5b37f784fb49b6afe774ca409cf486b43268947ed458d09402d124b3ad15fa0ef2282fdb83ff271c8b75c647e159b4b

  • memory/3388-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/3388-901-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB