Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 05:56

General

  • Target

    9cbc3cd68a4d0a197a04484d9082e720N.exe

  • Size

    36KB

  • MD5

    9cbc3cd68a4d0a197a04484d9082e720

  • SHA1

    5f69f372f763c33629489f4fc5d22f573ddc9ed2

  • SHA256

    4948b4e3b984cfe6fd1372f60b4c50fe60c40bf121075516d0f7e13fe3c64c4e

  • SHA512

    66d1f6ea73023016dd056e734e9055a822bf2659c84f94536a4808c9b86f0e3fe51a818c8f22e8e862562dd1261473830e82a462dbf66aafe1add69329836a3b

  • SSDEEP

    192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHbkJkFdLWi3dLWiU:yBs7Br5xjL8AgA71FbhvCDC

Score
9/10

Malware Config

Signatures

  • Renames multiple (849) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9cbc3cd68a4d0a197a04484d9082e720N.exe
    "C:\Users\Admin\AppData\Local\Temp\9cbc3cd68a4d0a197a04484d9082e720N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

    Filesize

    36KB

    MD5

    46e6c9190ca09d1c119b8e157739933f

    SHA1

    7faa29405a3a5d66bea9f82f529164af15df8048

    SHA256

    e2625225d3672a608e9ffabe254d4abb17124332b05f969ae6251089e4409d33

    SHA512

    a4fc7fa4700b91e2bab07cb7771969af17d30f296c05178dd10ccee421c5cf16f75775c7c9e15d139b92c1ba3a00cd103b4125476d1dcb8983f8f2c6cc14c681

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    45KB

    MD5

    074fc3184da0ae703284821177e903e3

    SHA1

    f4e879e685d16b84a9872972ffac6c39ebf53532

    SHA256

    3589a99bf84d65bec320703da81476e43a5f890c9a4ad7cf03fca12da972827f

    SHA512

    cf0347333783407d6d162a12f03aa65993766d718f7bdb6926356bfd37fcd7c433392daff7c0bb5e0b4a1c8f1d1c1317f19229af63bccb117400c62bc76bc8da

  • memory/1596-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1596-98-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB