Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 06:02

General

  • Target

    07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe

  • Size

    26KB

  • MD5

    3b8f64203c4e7c0c2ef16712fb37be70

  • SHA1

    54f6ab0756a22621dfbd14b3eab543a6a6a090a6

  • SHA256

    07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6

  • SHA512

    0a4d92afd89ae5e45cc373f69e33f491eb71283fea42625c1b587d8095bf80e11f5c00308a5ca52e4f50f78988dc9d54e5a805c9f3fd315b8562e3ee1a0ed37b

  • SSDEEP

    384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9gpw:kBT37CPKKdJJ1EXBwzEXBwdcMcI9gpw

Malware Config

Signatures

  • Renames multiple (5244) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
    "C:\Users\Admin\AppData\Local\Temp\07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

    Filesize

    26KB

    MD5

    e94e61bd9b57eae21b6ca8c6d065f495

    SHA1

    9690d8612dcd365a7962581228404206f81e4e00

    SHA256

    3308bcc644e059fbbd0e3adc6c399a1451ad55d1bb09625e6f0cc639e2a63043

    SHA512

    42320c235e87027c0d050fc656391b9849b4ec54d11e02e82ea8c0826d4bb8a08074db3d89a4b348c31ec35b41d8b826158ae7c4ade017a20391d058572c8b45

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    125KB

    MD5

    bc5796cf55b1adb1fcb8053f05692955

    SHA1

    1c14f73abdbf5ffc7111a9b9a71fc355f797977a

    SHA256

    fcea44f5c0a2cd017a5afdd4e8fe1eb324d46b0e529e1fbd26234f71c77e4b94

    SHA512

    8ed9c60923a3b997f8d7e9db0afcd3d17f5565c994b509fc4f239730cd01612ba560d9391c7b288172c2dd02be57460ba3a27a5526e6ee843fff1567e3dfaa4f

  • memory/4772-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/4772-1033-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB