Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 22:08

General

  • Target

    5ea6525ec120d2492e81131c71fbf9a0N.exe

  • Size

    38KB

  • MD5

    5ea6525ec120d2492e81131c71fbf9a0

  • SHA1

    713bd07ecf6ae51a5de33d05f2809e73a9a10a61

  • SHA256

    fbb1f860c7b0ad5b7228875390c09aa580587eea76c05fba2fe7c0bb11c36041

  • SHA512

    7a38c3017c4f57a00746b36abc001c2d46cba9457c387dd3be109351d287dd0511807142a83765747514d2b5298e6eb36e0162cc015dc3e6da20877fb523c055

  • SSDEEP

    384:yBs7Br5xjL8AgA71Fbhv/FXtqAYa9tqAYaq:/7BlpQpARFbhTYajYaq

Score
9/10

Malware Config

Signatures

  • Renames multiple (3228) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ea6525ec120d2492e81131c71fbf9a0N.exe
    "C:\Users\Admin\AppData\Local\Temp\5ea6525ec120d2492e81131c71fbf9a0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    39KB

    MD5

    dbe3d28f2f0b2885396882a3793760a0

    SHA1

    5eb70aafa10eb4df131e1088f389421a7287ebcc

    SHA256

    4692a27328c271834456494605ce3d0856f3f6245ccefc0db5949dbe8df8245b

    SHA512

    ba9a172dbd5a88056440a0614ffc709b6e8c37fa9f2d5906b1bbf6ee808a20286a5349eaa7d5fcd50853b305e9c669143bf636e3f5f2fe6c1d02a29d377bc549

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    48KB

    MD5

    da0b3ebb3280d81613c5f637f3c561fb

    SHA1

    dcf0f088040f0accd20fcd301201056a17c365e1

    SHA256

    01a72fe1ddb82f015f5d8d08e19751e83067e54e2158f7109a1e667d9947c250

    SHA512

    fa1193fe29362899470f5299f9d3daca84056eb8a86acf8b1c6111bdc444cd4d7226f7f9dfa49062e6675679c47c005ac7b85e1468b8d1890432f498c29a76f9

  • memory/2212-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2212-646-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB