Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 03:37

General

  • Target

    2025c3e03a29cb23b61b58792c95dfb0N.exe

  • Size

    44KB

  • MD5

    2025c3e03a29cb23b61b58792c95dfb0

  • SHA1

    24d7e83d36f5bfd915baec364f62a0142d36da27

  • SHA256

    e15e7fc70a4e57b6e95cce5ae6495a9d9cc08da28509966077d59688f9b03515

  • SHA512

    ff94d2a9d34c99af8fb8592e4e7d9de12c38e67b99d12ba7427ba404b8da54a8d2488027725094b16fa46b8e84d5b31a0f3c03a9a22616f8d8970fb65903d229

  • SSDEEP

    768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5n4fZ9Z34fZ9Z0:W7ZhA7pApM21LOA1LOrtkpt60

Score
9/10

Malware Config

Signatures

  • Renames multiple (4642) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025c3e03a29cb23b61b58792c95dfb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2025c3e03a29cb23b61b58792c95dfb0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

    Filesize

    44KB

    MD5

    37bab797101bd9cfc173ddb83cdae795

    SHA1

    2df160369b3031cb559f99d9f2dbdef150019be9

    SHA256

    29e26b4d0a7fa1fabc494747ac92c707995fd639d6c84d7364c1ecccaf61ac98

    SHA512

    1cdfba7e0fe7ad5744c9e6a112eefd0621953ad898ebcbfc6cbf723d3099facabe0fa3547f161b725e6c66215bd1dd74d732013adf4757326e2d9334f0545fd1

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    143KB

    MD5

    e697c43c9c11c6caf98ab20c2feb1e94

    SHA1

    d5ad149f655f0f76b8d3932d07503d2d572bdb57

    SHA256

    d099451b5e89ec0fa16cadbb809bae21314f31926e18d0186b2c02fd7e0df7e7

    SHA512

    371a157ed169be9cdab0fbccc66897879b01f749fc6b9c056728f2a153261cde89ebb68dee1b6594e5990709261275be12ee5d55009984cd0df766e4d9b55e56