Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 19:44

General

  • Target

    f075712abc2dd0c21c8bcf7fb6c8e870N.exe

  • Size

    34KB

  • MD5

    f075712abc2dd0c21c8bcf7fb6c8e870

  • SHA1

    9d371b8419d5002893bcc0ae7a8281b3d3640414

  • SHA256

    895b86327255c123583f613888ca68b15e843df67b8ef92b6883ffebbc16dec6

  • SHA512

    9a4f84427204bab811d3e1259265972d07ca7571f6c3b32ef6d395125d616a9e7b40eaa133f805d35758ed20a3d07fbb66a940e8e9e3a0584a09a8801d0a897c

  • SSDEEP

    192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxjJY1MEY1MQ:yBs7Br5xjL8AgA71Fbhv/FaMVMQ

Score
9/10

Malware Config

Signatures

  • Renames multiple (3123) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f075712abc2dd0c21c8bcf7fb6c8e870N.exe
    "C:\Users\Admin\AppData\Local\Temp\f075712abc2dd0c21c8bcf7fb6c8e870N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

    Filesize

    35KB

    MD5

    56d373853d58d57ebf7df214ea4571a7

    SHA1

    527cb5dfb3cd74bc8b1aabb4c6b147cdede506af

    SHA256

    6c419983df64b7eb5c0b354b1e5c25b8c9ba0a211489c30841c285747f2feb2b

    SHA512

    593885dccf4f571cc03695db92f1c40c9be791e9ce737fa71499015add2fe24b34605da562d257a6338d27a0e0189ef567bed4eb133a57ce7d9ec1d62cb3401a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    44KB

    MD5

    694f9e2d55f54ab0e291c6e62617eaf1

    SHA1

    7991cb1e27eadfdd54f12fa3364b9fd5c8e42161

    SHA256

    3ee0ba1b117c0abc6db55de87d70d7db45232482b453db1d38469bc2e1b3c7b9

    SHA512

    2c32e9b7ecdc5e56853d2185328b80c7168076d9da51034223ac7cf1024fcf20ab48c8b5b4f1abc893b2288737257651a7ce504716a5ecf5bd69f46cb248839f

  • memory/484-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/484-526-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB