Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 21:41

General

  • Target

    517f1b950793a81dfafc8d61107809c4227e9e6fb3e25ccde4925be1ff545908N.exe

  • Size

    66KB

  • MD5

    8feaf9341313bc1808ab32f7e111e910

  • SHA1

    3fcb28bc538a3ab1b773285ffbf15efac76561a4

  • SHA256

    517f1b950793a81dfafc8d61107809c4227e9e6fb3e25ccde4925be1ff545908

  • SHA512

    0b8dd3847364812c1951e69e641c42d7aaa6564c6e5ce6afcc4a0112e6abee1aa2ce72dab00ac5195cbc99b71cffefb7b60e7826b365f6786404a73f9827ff2f

  • SSDEEP

    768:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7u595QUhUB:/7ZQpApHou595QUhUB

Score
9/10

Malware Config

Signatures

  • Renames multiple (4357) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\517f1b950793a81dfafc8d61107809c4227e9e6fb3e25ccde4925be1ff545908N.exe
    "C:\Users\Admin\AppData\Local\Temp\517f1b950793a81dfafc8d61107809c4227e9e6fb3e25ccde4925be1ff545908N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

    Filesize

    67KB

    MD5

    7a0f78e346566d09680aad11ab68e94b

    SHA1

    17ffa9a185f66c29d9cff5be4f01844cc5efdd6b

    SHA256

    06f73997f7a6bddbce8b1ff280158e99c578ca27c2aadca028ae1ef482caad59

    SHA512

    e612922c7b44ee97d3145f960abfede90573fda11d93c53d65730d618919ea42acc5f4fea6cd8bc751f68783dab2231485a7177b7e99b9540cd8a3cb1912ef13

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    165KB

    MD5

    143ae5fe4700a366e66c6a30007170dc

    SHA1

    59ec0cecdf546aa79a2d1c6279882613b2cac235

    SHA256

    dc8a209d580a84883b403e09dff247e8fbff500f65f6d27ecbac57899faa6644

    SHA512

    82cdcb3209a45621a4d381e33a1a432866e77e2fbfb652b2c73eb977067302429f0f8bee8190eae4e1b1de94fc18e3cd7a842063178160f363443211ce7b5a6b

  • memory/2500-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2500-718-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB