Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 21:42

General

  • Target

    5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe

  • Size

    51KB

  • MD5

    a608de1ca455536aca850f9b20e7e3e6

  • SHA1

    b426606a31e4cfb5271b4fa7be56191da3af2684

  • SHA256

    5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca

  • SHA512

    062e1ab5292bfe5f394de664d4b60dc3a7944b8f69adb0783f4ab303eed785cbfe6a4d083d5580ef99fcf3095817ce72bfc671db795e98fadd519ed3fa8b5281

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9nP/+c+l:V7Zf/FAxTWoJJ7TU

Malware Config

Signatures

  • Renames multiple (5209) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe
    "C:\Users\Admin\AppData\Local\Temp\5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

    Filesize

    51KB

    MD5

    1bf72dd5a33e1030a78438dad13e010e

    SHA1

    2a37d3cb94720e684885a4c137a0a96062e95678

    SHA256

    b2c7d03ce91c451e43380fa2855483ef37ee528e3fccf8f96d8c509668771bcc

    SHA512

    b2d32cf68a10f3814620a9f805086078b798f68c8fba5862ac1e50fcc1e178f475252a15a62c80d627da816718a3f5390a080bdeb422bae28a36c1fa2191005d

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    150KB

    MD5

    a81de67360e213b7c9bc2c07b9c74f5b

    SHA1

    aa6612bb538cfb292de91f1bd63fe3a54a84c9d4

    SHA256

    e9e9a6c6c8639f92088e4be08c2431a87f843130c5cdf24aa55eb12c87f5e61e

    SHA512

    11bdc854330ffaa14b701bf762d41aa530b58db78a837e7e0a592c2e2dbda7668e5f0e15dddce22e076abab947f33eb96a2e9b6a8cbbb9012a499f541ef465e2

  • memory/4516-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4516-874-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB