Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 21:40

General

  • Target

    0fa8974089fe15ae4a6528e814b7cca0N.exe

  • Size

    39KB

  • MD5

    0fa8974089fe15ae4a6528e814b7cca0

  • SHA1

    197579d7060de3de319ea859983c2b582276b3f3

  • SHA256

    6b44412f4372f8a782cbd1a5f86c8304a00909de0e447a623aacde9dfb0c45c6

  • SHA512

    188a5f499ffea0fbb5f7e784270bf82ce03c136f799c6bd304b61c0ab65993470ac36b2cb5178ece21b110d4a15b1aa930f30ac4c62668f0c122d82d5f68dd70

  • SSDEEP

    768:W7BlpppARFbhjbhQYjY+WyKoIWbsHfySkT5GeQbyi348oWc1RPOzkjId6q8UdrSn:W7ZppApBMyKoIWbsHfySkT5GeCyi348Y

Score
9/10

Malware Config

Signatures

  • Renames multiple (3229) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fa8974089fe15ae4a6528e814b7cca0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0fa8974089fe15ae4a6528e814b7cca0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

    Filesize

    39KB

    MD5

    3f1f1cc44d7f41a28e2bd63284de05f2

    SHA1

    87fad2395d0d5723e37fe017e5cff39c7cf1b4ae

    SHA256

    21e93d969c3d5dbcd5b3dcc36a1e6868e4ee9746ff486a2b9b40c2fe96540932

    SHA512

    03bfb2583a1c3b2603cb08a4bcfb830416e6d145a60784d8a019e14050c467d712ed646c0b7b0783a9a069e21a354aa73ab3f9dc9eb35354addc9ec107f26d08

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    48KB

    MD5

    576c1e6e896a5b9d55d3e4a366338f49

    SHA1

    a9fa21c138f9eadc96bb57c52d923e93882f2d29

    SHA256

    28c1fc0b1a398e7b1c28c617eb6bbcb496976884673f2fbc32d7b93e8897e6a9

    SHA512

    e234a676c220e5ae0533fb80658d33a9a12483d16193efbcf8ceeca36ba112ffe343cdf12b020f301b3b8b8b2f23045bb262f1e722962b55a5446323d5d67929