Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2024, 23:31

General

  • Target

    7750b8a05d7be175668b1c2bec7c24554c7a9f813e67af964d038643ae819ca4.exe

  • Size

    52KB

  • MD5

    9f8da5c42a7ca04061653ecfea1237ad

  • SHA1

    3c50e18d42429fad1c9953c6ae7dc49d294e7a49

  • SHA256

    7750b8a05d7be175668b1c2bec7c24554c7a9f813e67af964d038643ae819ca4

  • SHA512

    8bae66a085326d96fb552b9f450d184b8c01b858f17e5b456db879e3f3a38b85b1a3842084b771eddb47feda58c8bea50b6f0848260b54206d4c25d155845eba

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJf8:V7Zf/FAxTWoJJ7T4ML

Malware Config

Signatures

  • Renames multiple (5035) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7750b8a05d7be175668b1c2bec7c24554c7a9f813e67af964d038643ae819ca4.exe
    "C:\Users\Admin\AppData\Local\Temp\7750b8a05d7be175668b1c2bec7c24554c7a9f813e67af964d038643ae819ca4.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

    Filesize

    52KB

    MD5

    26e94ec585cc26dfd3bec81d73bf2505

    SHA1

    cbcc65ce3d1b045afc3bc0d6d6f9bb3bfe3162a5

    SHA256

    acc0f856a1bf3fe655986534e014ed276afe62cda1dc008e71dee61d481af4d3

    SHA512

    dd8abdc02461557cb6bf9f2b7d17b75a73faf1274fce2335406d72bfb71b39f2e9d6b093a1c851865d07e8b3a21af5bbbb55c9411823d549d26a15ad00004f12

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    151KB

    MD5

    45a32e43568284ed18515d9b3ce7a47f

    SHA1

    0e03a7973885e69303573edb6f1a06fa90f6f472

    SHA256

    20af2a4e8957254ffc2e19d59e9abdb18f4e461ed7a016b6e881fc127c87b245

    SHA512

    480f27a84ee672a4e40dce0544db9ec470a77ad0722b1adc43bce1dcb1c1dd89bc63a6d6efc4f9dcbd4fd46a75b8b65f217e4f48d3a02206b443943ebce3766a

  • memory/2368-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2368-762-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB