Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2024, 02:56

General

  • Target

    e9eeeaccccc6ede5651cc09c4a66f603ab502adb142fd1ede65731d86dd03aa2N.exe

  • Size

    70KB

  • MD5

    8271adfa6219573c5401d6f927c2a4d0

  • SHA1

    ecf7cf095d0e32d5e68bd66cd772f522be1b6308

  • SHA256

    e9eeeaccccc6ede5651cc09c4a66f603ab502adb142fd1ede65731d86dd03aa2

  • SHA512

    9f3c04ee9b8ea9129e827609fa64a401bf26a380fa753d3baeee1839600759557966e22db96a3621bec4760bef86166692708fc033235219b7f37aec579b2dcf

  • SSDEEP

    768:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7u595QUhUey5vhgCy5vhg4JB2JBE:/7ZQpApHou595QUhUBgtg4JB2JBE

Score
9/10

Malware Config

Signatures

  • Renames multiple (4372) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9eeeaccccc6ede5651cc09c4a66f603ab502adb142fd1ede65731d86dd03aa2N.exe
    "C:\Users\Admin\AppData\Local\Temp\e9eeeaccccc6ede5651cc09c4a66f603ab502adb142fd1ede65731d86dd03aa2N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp

    Filesize

    70KB

    MD5

    09e6324d4d997280149c7af3f67fc861

    SHA1

    3b6e8718674c8fd881075067353e0c1410b8606d

    SHA256

    451fa0e1772402b84eeec5645c213e22c5be17bc223cdcb4a82ea177242c6bf3

    SHA512

    8185a0a543f0552b46fa1d8106078cc6097d5ea91a5d1ee68d0087b61060ba36c09aab54f141f95d2d4f2bbd78d355368b85fc7c718f6a0f7857369989adc264

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    169KB

    MD5

    777027b185ae0a733c4a51372c648b81

    SHA1

    40c90a71ce7bd9683eae59bf5a392aa7b4d29fc1

    SHA256

    da122a01113046c4739fa3d3668535449e601fb3f451cca694e61540570e336a

    SHA512

    311536f5857441adf3d5ff0f2f5aa58be336f282a81a8e2c56ac97314dd494ffb8d089f08c9d3e8e8b85521c076509c12176995a9a40d1737e4e937eaf751a40

  • memory/1952-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1952-664-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB