Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2024, 00:33

General

  • Target

    baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe

  • Size

    91KB

  • MD5

    5671c8bbf9e774c71417d4f5ab358310

  • SHA1

    79c00fb2a4735798ba6ad68d0e7962568a580a47

  • SHA256

    baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55

  • SHA512

    5a734516e34085404bf6ada7cda5ea7e217be295879d0e2a9f643bfa4f999470ae921691c1ae3e49ef99c20ceb712be6feafdfb6aca86cb188b4700bdeedefb8

  • SSDEEP

    1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGLtErm:6e76mQSohsUsUKDtErm

Score
9/10

Malware Config

Signatures

  • Renames multiple (4872) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe
    "C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

    Filesize

    91KB

    MD5

    c5a337e526b5a6535963a052cff11bb8

    SHA1

    e5c4457d683f81f0b42f34ca9787bc6aaf879ffe

    SHA256

    4fd2417fc088663d96d826fda0aba79ac1dcb0de9329c304b8d5f678fd8714cf

    SHA512

    40930826023f087a55e7db869153a8b02bd02d112aedbde6f9eb409a8f133e3e6447f59836446ce9b310c6448999380106e14dd6293095a3b8b58e586d2c4d22

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    190KB

    MD5

    bc4face9ed8e2aa180957b87762fbe71

    SHA1

    5ff6e98c8f763b34d6ff8fd1cece5193b2fb7409

    SHA256

    d8e642ddb436082ddaa6753e93ff6cdc2df4a2864a50158e68486ce3cb44e0ac

    SHA512

    f09bb1495eac45795413e35278c53639e0bc956e35806f6d4d548024114f3ebac033daf6e8c404628781f645fd80a1c3777e3d1dc12737c5c4d31a7b3db2a976