Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 20:35

General

  • Target

    3a3fa327cea6d8437f82598e2691dbd323ad6bf0efd4c6ae518269029c756e01.exe

  • Size

    36KB

  • MD5

    d465741fdd1c00c9de0f593847df5803

  • SHA1

    e10d6f4a0a3561f7dbed688a2199e0552bfeab32

  • SHA256

    3a3fa327cea6d8437f82598e2691dbd323ad6bf0efd4c6ae518269029c756e01

  • SHA512

    2a47ad01c7af6fabe67db8d361eaf6499d1a6efa72f5313c6775ab974039dc1cb330dc8c2c00c102eb42ac5d5f80ba7f4250209441d4eaf678afb4bdcfc4afc8

  • SSDEEP

    768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBApwp133EskmKsN33EskmKsKbP8/8g:CTW7JJZENTBAOIfmKJfmKs

Malware Config

Signatures

  • Renames multiple (5198) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a3fa327cea6d8437f82598e2691dbd323ad6bf0efd4c6ae518269029c756e01.exe
    "C:\Users\Admin\AppData\Local\Temp\3a3fa327cea6d8437f82598e2691dbd323ad6bf0efd4c6ae518269029c756e01.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

    Filesize

    37KB

    MD5

    cacb3263a5e4e0a4f777d6316244df6c

    SHA1

    09f113e99e7546df268ff2a6a999c5ed9c4c6904

    SHA256

    788ad34239ba4ce91c0a44e24a02853f2c4737097d7c16f12619f356eac22af3

    SHA512

    52994a353f0d8d37b1d803a6d9cba71b323859fa63a444fecb086d07d69f7f3e36dd077d8f020b0a936cd142081e1f291e63a42512882b3149c5441bee33c055

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    135KB

    MD5

    1afb38b951518dcf7b9691bdf86cfbc7

    SHA1

    2e3e5f65c1028168f7f21634ee4390205be93eb3

    SHA256

    b9662e4233ebd153f91a0084a8a39a3b8305254169569465af667d92c5d5b818

    SHA512

    708b06a7a338c83a1ad96faf9a558170c57c05d86547be34db36573fac54ea537ae6b30c6e4158951c45fc9fcfaeb985567995c635008ba739490eb45a937c7d

  • memory/544-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/544-916-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB