Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 00:45

General

  • Target

    965ade84a578160b864666f38e06761dd04ee3d84f9a791d6df647a4224c8fec.exe

  • Size

    72KB

  • MD5

    ad23b53a5771a5bb95cd31ab7a108854

  • SHA1

    f92d9cc8499a8da033ea0420418e45679bdb7477

  • SHA256

    965ade84a578160b864666f38e06761dd04ee3d84f9a791d6df647a4224c8fec

  • SHA512

    282f4c0d62baecec1d835e3de27eab304b12b52dcc9677845951597655e95b204f26384295f720b1e8cc19d584e78ba4067f4c8dfcf4e5880c69adb1ff366548

  • SSDEEP

    768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhXRFRo:W7ZDpApYbWjIoPyPoLzV7c6ShXRFRo

Score
9/10

Malware Config

Signatures

  • Renames multiple (3581) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\965ade84a578160b864666f38e06761dd04ee3d84f9a791d6df647a4224c8fec.exe
    "C:\Users\Admin\AppData\Local\Temp\965ade84a578160b864666f38e06761dd04ee3d84f9a791d6df647a4224c8fec.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    72KB

    MD5

    bd92ceec3ec26db7f90b91e90f8abf63

    SHA1

    84e2e0ea1de76a2afe9f91e387603291248efc46

    SHA256

    e22df03b885b50c968b368f693bcdafe3e6a0feec558467fd24e2063c56da8ec

    SHA512

    1ea6baa54bb88f155a8bb0a3996bed450c926a35b02e7bd46dc3fbf5a9082ca72a824701c532f949867e4e50626a8dfc6b89d1e45901653f55d4a00866e37dfa

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    81KB

    MD5

    8dc2cd38cb6d0b64a16f579ae09acaa1

    SHA1

    5ed7a05e5693c59c95e5bbfb58b1a909aed77a4f

    SHA256

    12e1d0440e51dcf3ef8dae16662f181c0171cc26391a9d9ebfe98fa37d1680e1

    SHA512

    34bcd1e87fbbb19e7a16d5fd51cb78163ddbe091ded7f88e3135ba5dbf8ecb44d725a2fcb671a3afd8e8a0ea883607c0f1a3ebea9dedc960c26d41b49dd65abb