Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    92s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 22:29

General

  • Target

    1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe

  • Size

    29KB

  • MD5

    fd8b750646312cc62b65667afcfaaae0

  • SHA1

    33fe7f3655eff2b9a902c100602edacbaa3cae2f

  • SHA256

    1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2c

  • SHA512

    5adebd2cc188e46a667099a42bc5fde013c5dfb871c1678afa05f3c1dcb6eaf053ec531b641b8a346805c62e3e504b5631166a4a21f7fd2b9e599589c420fd36

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9yGH5BH:CTW7JJ7TPTH

Malware Config

Signatures

  • Renames multiple (4673) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe
    "C:\Users\Admin\AppData\Local\Temp\1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

    Filesize

    29KB

    MD5

    46f45c7e1c3cd0c472c29ac06336d5cc

    SHA1

    1904f0932b2810213d0d3775834fa8c87a54ee26

    SHA256

    2d368d983136731ae39d3d6aa679cffb2683e9028d889bc71f2931f2cbc252aa

    SHA512

    e0f00ba7368b0a3b01f0f348dbe876f089800bd49b3b74997f58ace2feabaa49ddd4c6a8b611e10f0ac4f1af6735e5ac654e9b374dc211c0063f0d1ea472f226

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    128KB

    MD5

    48710b889afb8121717b81ffb67eb2f2

    SHA1

    493f8a723e22b3c79a5d5252d13050f588f13fb6

    SHA256

    c10d1222c88ef854afc2c6e06a96a24767dc2620257c9feda430b0d7c53ef68a

    SHA512

    bd28fcd2f0453b076f7906b9a663ead232fc8598e3ca7770119bcd2f5c47839343787da8d8f96b0147474e7f87b453d245490f8498fafdd77cfd3e327f22f655

  • memory/1596-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1596-1001-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB