Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 22:20

General

  • Target

    e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe

  • Size

    72KB

  • MD5

    ba33a95231a279c05c015444b0727ca0

  • SHA1

    51258bd670b5aad477f7978cf7e527b33d48d60c

  • SHA256

    e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113

  • SHA512

    3475d30da2c1bd6b571e806e2108ddc94a7d7daac7e9e7d829beec36fc1a72e92e1570f41a77d5de6a3ab63e3faab3c6c04b0f168ce416040c96e58b499a540e

  • SSDEEP

    1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8yNCNzdwEbdwEE:62ssWpcU7lK1lKgkE

Score
9/10

Malware Config

Signatures

  • Renames multiple (4368) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
    "C:\Users\Admin\AppData\Local\Temp\e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

    Filesize

    73KB

    MD5

    7bec0ac2720a754ea3fe25fb92ef60cf

    SHA1

    f70bc6309ef148061f4cb4404c41cc3861b011f9

    SHA256

    5a7250a475b65e6c8e23ae223f18e98c96b729e62227c689450021547246f766

    SHA512

    d661a564c86d55e7c80e4af9dd5f853d62a007b6dd1da5d9f97e4752eb9f23eed7b40e58c87376e7a61f5aca1b8385582f55f06cc5444e76909332566ef34093

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    171KB

    MD5

    4f1e98707f67ce1836ef80d11a19524c

    SHA1

    f17df918add52263a3ac581bfe22e39b1666b40a

    SHA256

    77a26d067d8b2d60b50474cc9fd2347ea216f270b254e74110e49eb1c1e9ddbe

    SHA512

    35025aa1a4308df078c43c86e9d5ede9ec2ffa0574af1795da330fc39d7cacc65918af985a39e2210638fd1d1d76fa2e3efd901a940aeab54241b084f356b311