Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2024, 19:41

General

  • Target

    245de1cbc22ea78f52ea44a311d928b9c34a6fccbb38d2ea77290f59b610fb29.exe

  • Size

    91KB

  • MD5

    676841f741fb337c08e8925536bb8a4c

  • SHA1

    43d7a37fde60196ef198457d61e1b0ea992dbe3d

  • SHA256

    245de1cbc22ea78f52ea44a311d928b9c34a6fccbb38d2ea77290f59b610fb29

  • SHA512

    6fb2e1e083962b3a0b318364e5fdb56194d8a9dfe198cf1f5703c75b04301314ac94d088cd8540c4e129c6f10d78a93ab7ceefeaf8a1f18606fb4019b16ec417

  • SSDEEP

    1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKP76i:6rWpcOPxPke+e3fFpsJOfFpsJbgEr

Score
9/10

Malware Config

Signatures

  • Renames multiple (3541) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\245de1cbc22ea78f52ea44a311d928b9c34a6fccbb38d2ea77290f59b610fb29.exe
    "C:\Users\Admin\AppData\Local\Temp\245de1cbc22ea78f52ea44a311d928b9c34a6fccbb38d2ea77290f59b610fb29.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    91KB

    MD5

    66a24ea3ba2c89ab602d02751f78beb6

    SHA1

    8963e07d464d9bea37488f53abf37e8ef4995c12

    SHA256

    dac6c32041c1dd1b4e2dee604f07e0e819e1f6d98c9d38f659e527eb856562b9

    SHA512

    61afa8d5b89e2f0cd1efd8c0feec7c375c8ff28c43e26ce20deaab94c2215e51a70bf1e8a5b2a2e282714f1fe01c27d12957a1f05e1f75948f2cb8e66448aa76

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    100KB

    MD5

    2f15e3a05545b4694db21d5f4db45b12

    SHA1

    0f40402ac3f524a6f2902865730512a9a28c0f54

    SHA256

    9234800859e968843213d26034221c769633351678ed8d523f9c447bb5062a6f

    SHA512

    ebd651255f11670823d70d0e0223a3daf3bb23cdebe77930d0aefbfb51894431db4b06074aa97f98692d1f14c00a6dd858151c9512fd9cf477d3ce232d1c00f6