Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 20:41

General

  • Target

    2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe

  • Size

    36KB

  • MD5

    c05b73c7c2db231b49586d8d255a8ffe

  • SHA1

    f3ae3054419cdd2cc4a859f63f2881600a89820f

  • SHA256

    2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae

  • SHA512

    c10423b7de52a9d98742b3606a24aa11f1d604cf2f18d80cbe485a9eb5c5c13eda3256bd639eb831601d8d2e1c9a0876c047b70816d2913b65ecfaa8f846b480

  • SSDEEP

    192:tACUADIY0Br5xjL/nassAgAQmP1oynLb22vyBX5HAug4j4fPUDN5HAug4j4fPUD1:GBt7Br5xjLvassAgA71FbhvYD/DMG

Score
9/10

Malware Config

Signatures

  • Renames multiple (2276) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe
    "C:\Users\Admin\AppData\Local\Temp\2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

    Filesize

    36KB

    MD5

    8c6f331d7e2b58d22f1da004066c2508

    SHA1

    d6c7a590b5041eec2798a3796295582fc534a82a

    SHA256

    94d3ebbacecf6a812f9d9a12833927177e14be7607240c595514c8e3442f41a4

    SHA512

    7f7c3c845cfebd5ef076f551a458b02cad635a63f4006e23fd397cbbffd9dbfa0c54003018a096c36e7d893fe400014ab9c26b2b4d32ea19fd241edc67a0d8a8

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    45KB

    MD5

    ca7dbc4b7c3db6f0da0afc2150e4d6e9

    SHA1

    486588de8c17252f03622803804ea1191e1fc008

    SHA256

    75346e5c5c13fe32f8f20c4e3d54a5a97d7024d48472dd4a067974e0c9e6f67e

    SHA512

    e0d4e490f83b5348baea903e7d80f95871e71116d0eaab7b4eb0e36d12f7c2f1eec4cb41f51e8655cb5a4755f8808ca4ef5019e49e1800a4aacdf6fea55c1c35