Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 23:56

General

  • Target

    71a21aa06b469a78e9304727da7bf7878f44b728a85dc82d782abaf0a71a7a54.exe

  • Size

    35KB

  • MD5

    2d45cd4aa36d77578c310e99535ae74a

  • SHA1

    63c51c6a5f459626a11da0fa30d617f7f331261c

  • SHA256

    71a21aa06b469a78e9304727da7bf7878f44b728a85dc82d782abaf0a71a7a54

  • SHA512

    48f938a89789f7237945f8702a7834a274e36618ac80a3c6a9513a429d15a21a768204bb7dfefb9e806c67cf1c0341cc75cbcbd522b8053520317538a23224e2

  • SSDEEP

    384:GBt7Br5xjL9AgA71FbhvuNBNQFQZUDqo8Wb3Dqo8Wb+:W7BlpppARFbhHFQZYr8WbTr8Wb+

Score
9/10

Malware Config

Signatures

  • Renames multiple (3709) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71a21aa06b469a78e9304727da7bf7878f44b728a85dc82d782abaf0a71a7a54.exe
    "C:\Users\Admin\AppData\Local\Temp\71a21aa06b469a78e9304727da7bf7878f44b728a85dc82d782abaf0a71a7a54.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

    Filesize

    35KB

    MD5

    3a9196f2451e9b743fc32424b919f76b

    SHA1

    9dda1394f66ffd8bf8ceb1cdf321ffa1a67a3a5e

    SHA256

    afeed8a10da0417a8dd8ab9f3dc4b80b46492a2c43e0f2c110369e2f8cc9328f

    SHA512

    fea1131aca142f36c16db85d9f09dd63abbe0c407f470721e26f79cee100d01d29c2fa6bd5f92befd63c38ede87cd2910ecec9d3943b524d22624a58991a7da5

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    44KB

    MD5

    18e89e48e520c1d458813624aa6fc072

    SHA1

    e2dc140f0891899af69f9d73371facf5655d3daf

    SHA256

    2f50e6e3ef80a876ea3e5966ba77b4e71461a24d3fc114fc47b5a82a67ad62b1

    SHA512

    95b4cacd42036316956412d639cb8c46c387d454d5860645d1f4a311894f297e6a56c3d767d3eedcc6f2b11145f2ae0c7f4b0b5a45cf44272a64fb8701fdc0ef