Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 02:44

General

  • Target

    ae383c0eff2978c7aef34372642dd9b2686faa02fd26ad15e670331ac57774bd.exe

  • Size

    82KB

  • MD5

    26606d61f06fc98850ac15be3b9d7c1a

  • SHA1

    aac32d395a137e7fcdaca06ddd2eb09f3f1b15f5

  • SHA256

    ae383c0eff2978c7aef34372642dd9b2686faa02fd26ad15e670331ac57774bd

  • SHA512

    9499ff6aedcb4cc51d36ece24a9ea77560a7f90c58a7a9bcee39e4eb8ebaac3b403c3a7fa24010f69d442873b3d1c4d4cdb6b0d16d452f491211b97970f51a1e

  • SSDEEP

    1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76Rbu:6e7WpP9oVLQthbYY9oVLQthbUvF

Score
9/10

Malware Config

Signatures

  • Renames multiple (3741) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae383c0eff2978c7aef34372642dd9b2686faa02fd26ad15e670331ac57774bd.exe
    "C:\Users\Admin\AppData\Local\Temp\ae383c0eff2978c7aef34372642dd9b2686faa02fd26ad15e670331ac57774bd.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

    Filesize

    82KB

    MD5

    f175dcab77841bdaa785880db15b2ba6

    SHA1

    003d90227cfd0410140ecba4cc4e5c9fe59d1ea6

    SHA256

    e7e5fff77aeb0b88cb06ec2e47b10e616732b21590fbf986583dc9ebba6d3e60

    SHA512

    d75790af0365fe15238289965995a34a1f218a8d9c252302b315beaca2b3f41ce9d27b0ec1c365ceeb64a4e3dc14bfa3fc2b1ebbfb40d72fb4218bd1e0313647

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    91KB

    MD5

    3ba237ffe9ce677cea09416ce87fd148

    SHA1

    5f66d38ee814e4a0c4e88613abea5b412a61625d

    SHA256

    314006f050d3f692fc58dca65bc7788defb45a50e9dfac929d526b195094c249

    SHA512

    e0768934302468869d58bc13c763f251c490b729fcb0561f281b86d8e81a7314e8354fbc9f1ace52cc5f534ef614b46b33a3d9762e1104338ff3a19d34c36f3d