Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2024, 00:30

General

  • Target

    baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe

  • Size

    91KB

  • MD5

    5671c8bbf9e774c71417d4f5ab358310

  • SHA1

    79c00fb2a4735798ba6ad68d0e7962568a580a47

  • SHA256

    baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55

  • SHA512

    5a734516e34085404bf6ada7cda5ea7e217be295879d0e2a9f643bfa4f999470ae921691c1ae3e49ef99c20ceb712be6feafdfb6aca86cb188b4700bdeedefb8

  • SSDEEP

    1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGLtErm:6e76mQSohsUsUKDtErm

Score
9/10

Malware Config

Signatures

  • Renames multiple (4135) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe
    "C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2340

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

    Filesize

    91KB

    MD5

    678a39e098b2e9ce860b577e234c0148

    SHA1

    79f4b47c13c630a8de989ae56175b0d11e1a7047

    SHA256

    40ad2cdb4768f0f1ddf42a0e115ff2da5f275a6fdabcd804f997eb949c49e3a8

    SHA512

    712f6eaf40d7e6d4eecce870712d5c949cc4547b00bf0d87d7a8239b35db3da469bf360c2f9fae0027add3b3e3178274942bbe6b9a68a94148ada06089c2adc2

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    190KB

    MD5

    fba159705ec1bd6b6bb11c2474eac5e8

    SHA1

    a17fdca5647360b845f258d11070b274a76070f5

    SHA256

    9c06949b767276b2b068f73e71550c270f0435922a2364208588858e8e52b70c

    SHA512

    a53d992bccc7eca6eccb79ee4346e90192ef4e838742c4f822e0e8499eb63937fd35c70328fccbbc5f7daea63f6105a23f6e1eb0ebfcd813131b760b99a08821