Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 09:10

General

  • Target

    c5862f4ffcc040eefbdabf853c69d1d69194b0743b2bc8c67c2989aaf484e829N.exe

  • Size

    31KB

  • MD5

    cc8c2611c4a3e2b5fe1095fddfe9d210

  • SHA1

    aa8d852dc1d21afe352061658be483063ca0663f

  • SHA256

    c5862f4ffcc040eefbdabf853c69d1d69194b0743b2bc8c67c2989aaf484e829

  • SHA512

    0df5303756034ef6cc119aa501062317ebb609424bdb8317d90c6e5bf2bc695334dae3125b611244c11c379401173ec3de8b68e37c13b86f99fe21bd8c5195f3

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcI982AZJE2AZJ/m6lj3Ai1xQ6lj3Ai1xT:CTW7JJ7Te6lbE6lbP

Malware Config

Signatures

  • Renames multiple (4676) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5862f4ffcc040eefbdabf853c69d1d69194b0743b2bc8c67c2989aaf484e829N.exe
    "C:\Users\Admin\AppData\Local\Temp\c5862f4ffcc040eefbdabf853c69d1d69194b0743b2bc8c67c2989aaf484e829N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

    Filesize

    32KB

    MD5

    3158a686e3d8ee7a2e3520305ae71376

    SHA1

    bc12c7744cbedc6931891e412e75f8df7fb0c69c

    SHA256

    613ebbeee0e41d7e3a63ca87c0c1856f5291ea4390f425e99913cd6daab7d515

    SHA512

    9de85f14c11307c66ca4c537c9f579c2dfe290f1fe24ac12564e88ec8d4ffeb94f05468527bf4a3c17ed11c64b8be1bb5ebe10c9dbc384df80317704e223cac4

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    130KB

    MD5

    dd6c0254b37316159261563960623597

    SHA1

    552b6db363e144d7b7b565bf08dd0afc79397845

    SHA256

    5bb8ca88f7f3206e985210a64a6477d4d38b81f818d06067cd8a6ae625ad60d7

    SHA512

    32a845b9c05bb6e1ca774499dc31c9d8da1068ecd16cb2cb7e2c54be1f0478525a0d8ad87bb69b58bfdc2ce62fe5c2a6da7b10ea7fb0c79606018ceb536f1eec

  • memory/916-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/916-1015-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB