Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    19/11/2023, 01:53

General

  • Target

    57e2b4443e3ae17d48c1664b70de1730.exe

  • Size

    203KB

  • MD5

    57e2b4443e3ae17d48c1664b70de1730

  • SHA1

    4e3ea315689938b66b93e4a9058ffede91c2a52f

  • SHA256

    486fb689a71f94fabe0bb470513638e7aae120349917bd480a56852d932686ee

  • SHA512

    5f3b602a811602c0db338b2b247cebbe74f66838d005ba6b7dae066d4b1e4140aa44e271d18f02ebf06a886c2d2dd030bed550c1d5162bdf97e93fc7cb885db8

  • SSDEEP

    768:W7BlphA7pARFbhKKVeIuKVeIaCgx+qsaCgx+qswPNPz1Z:W7ZhA7pApaX0aX0wPNPj

Score
9/10

Malware Config

Signatures

  • Renames multiple (582) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57e2b4443e3ae17d48c1664b70de1730.exe
    "C:\Users\Admin\AppData\Local\Temp\57e2b4443e3ae17d48c1664b70de1730.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3425689832-2386927309-2650718742-1000\desktop.ini.tmp

    Filesize

    204KB

    MD5

    36532e47a237f592456d125d70594c2c

    SHA1

    7342dda1d9b9713b6302dea442c4181c80216a4e

    SHA256

    59a842422a7aeec0597f47b8edb9bff937f984966a329200096bbe7eddee35f7

    SHA512

    9a7b345081c2642eb2c7c6ee5e3b865f01d016a5318cc9f1332da40b6c867914fac4dae7363c27c61533fc667b5edcccadc149ed02d5355d4aaf2151fdc50a9f

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    212KB

    MD5

    e1a6930f600050c36f050a13ec266936

    SHA1

    97f476f08ff42f57b9bddc7b42946663e2927cba

    SHA256

    0af258be0ad86556128d23d350696b64abf9656a4fc299e18f559302540dd827

    SHA512

    e362642c362acf3cdd28a30abb67bfde06c7390fcd3c7d5905893689d0f33bd0ac07bbcc583daded3c6a15c970cb7a35022d330194dbf3190fc79e6d65e3ffae