Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2024, 04:19

General

  • Target

    5e93756da413bc106191fd8aabe36b13287a7baa3b18f94ec9405f9e34ed76fdN.exe

  • Size

    29KB

  • MD5

    742f25e38cb33687d578fd891a886480

  • SHA1

    ab8da306acbfe456085ec26b8f32434c9b718e4c

  • SHA256

    5e93756da413bc106191fd8aabe36b13287a7baa3b18f94ec9405f9e34ed76fd

  • SHA512

    d0d09980ae83dcd4f8a6a14c4650c9f89227181c40a7e76983adf84865ef9f423840e9b5a16dc4deb2a2017f2b712297ae56fe1c157beeb01ff8303998fd36aa

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Y9sRAJxA3gAJx2RAJxA3gAJx9:CTW7JJ7T7mt

Malware Config

Signatures

  • Renames multiple (4675) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e93756da413bc106191fd8aabe36b13287a7baa3b18f94ec9405f9e34ed76fdN.exe
    "C:\Users\Admin\AppData\Local\Temp\5e93756da413bc106191fd8aabe36b13287a7baa3b18f94ec9405f9e34ed76fdN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:5092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

    Filesize

    29KB

    MD5

    38ad54dfa1712e640bc0adda789b1fae

    SHA1

    4fc2fe0b0bfb2eda2e046e2e93548dde2ff1d75a

    SHA256

    892a89d7efb21a8e279a4ac15f9c64777bfe5ea41af2a429cef7b6b4f52d637d

    SHA512

    433790916cde7562f21ca6c94912b9474406a9c370697b8bc2bf6d3450d7d771954c491bc319c29aa814d147070037e5534c212aee883b39a93de15204cb95f7

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    128KB

    MD5

    ec638c3aa2c3ce549a6854223caeac59

    SHA1

    7dc7aa79ce4552b856e3768965738536c4dc9fae

    SHA256

    701484fe520a4723a15bb0e2c6fd1a0e76cdb7b52aff0deb90044534abaeaa54

    SHA512

    4e7de97bbe6f62f5ba4e5162c9e1a3abf774e78c040fbcafae6aa04b086f2317335cf352ca342a2d454668289e04d2a5b5f9cd57acbb5f17c206ec76b5a20b9c

  • memory/5092-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/5092-787-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB