Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    24/07/2024, 05:52

General

  • Target

    54abf07ae9936161f65ae05234382be0N.exe

  • Size

    38KB

  • MD5

    54abf07ae9936161f65ae05234382be0

  • SHA1

    8f73ed77be42ebaa409cf00dd8fb6855f0831a16

  • SHA256

    99ef342a44936bfbc9473e18fea3337b50557816abcdb65de41fe481047c0c0c

  • SHA512

    20c231371cd485e42947b71c4dd034974960f57f18f2f3ca50c46aa4bace4368bc144db07abbc8f0b693a0f2bd3610b08651d5b500984dc352d8d3e547a1c883

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFcdyGdyo:W7ZppApBULcfpHLcfpyDcdyGdyo

Score
9/10

Malware Config

Signatures

  • Renames multiple (342) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\54abf07ae9936161f65ae05234382be0N.exe
    "C:\Users\Admin\AppData\Local\Temp\54abf07ae9936161f65ae05234382be0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

    Filesize

    39KB

    MD5

    ebb761498264854790ff27f8d9312e9c

    SHA1

    38e10c119b74517304e7495d6723881d83f72e8b

    SHA256

    06369c133d38871023ea6fe46ade67b39fcfd4245d04db737ce58c258815c8dd

    SHA512

    e59613721841a2d885353b595a22973178aabc4defb6b52f7575f6e6e9803b53f5b63f314aa90b30952a28728cc662c4b7713dc03013091def9412cc71876441

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    48KB

    MD5

    ef813e3640cec0ccdefa104c098affce

    SHA1

    aaca592b0cf0ec90b557e0a320849c713b0ab264

    SHA256

    b0f2f7d20df6c55ff92003adca0f6327aaea853d4fa893ae23ea2704d32fbba9

    SHA512

    b5cac5e6d2511cbe37460a5f8197a887fa4d91b770fa52e971ad04b6acb007e779db69a0249de05cbf3dd1d3b8ba73e6903092eb97047c130e6887bccd05f19c