Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 20:32

General

  • Target

    e3410d39570191606215cefcf9837000N.exe

  • Size

    40KB

  • MD5

    e3410d39570191606215cefcf9837000

  • SHA1

    3e17e6070fded7b0315ca004fd2914d0c097949c

  • SHA256

    45f47a3b60ab87be44aa846276888222857c349e7e7326a5e14f9d8057ee1c3f

  • SHA512

    73f4749b1a785b90c603200fe1caa3261453854e334d6ce1bb39e5bb2f54e58d57447bad16038ed0cbc92f1834d01a477e2d6ef9e05861b83c1f843fa74d5727

  • SSDEEP

    768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8tiOeiOF:W7ZhA7pApM21LOA1LOiiOeiOF

Score
9/10

Malware Config

Signatures

  • Renames multiple (4662) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3410d39570191606215cefcf9837000N.exe
    "C:\Users\Admin\AppData\Local\Temp\e3410d39570191606215cefcf9837000N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

    Filesize

    40KB

    MD5

    b8351dc7c942d60a9331f756a74fdef7

    SHA1

    d7013b722e21e5cf592ac21d6c4343e46e19fccc

    SHA256

    35e0ba76cc9cd581e52de2faab2a379a845c81b3d05e8dd89676c88081ea4d7a

    SHA512

    747b7858f1b6337e8b60d20d851cd903ec2246a2103a1465aadf2f95e8fd34fcce03a2bb2d885920210609c818e190e27408766e0db6fdcd3804c28da34093bd

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    139KB

    MD5

    a428c613ec40115ab3930b6e921df515

    SHA1

    fc58bb79cf64d62b47ad7555bff290c1599b1844

    SHA256

    d12a746824cf2a471e64dc8b70008758c7adbef5026a2e977a84cb65dd370b68

    SHA512

    b20cbdd9ffc7d14573336fc302f460e747dbc830bb2030b82daf3337a52e82048b2fab43138c73acd090ddc4cd5d41df313b848f5ea5588ee157b91208bab1c2