Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/08/2024, 23:51

General

  • Target

    bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe

  • Size

    93KB

  • MD5

    c1b89eea3684fcfe040c9be9d0c16eaf

  • SHA1

    a8a91808ca8acd485326ca03d0caf9357c6ac098

  • SHA256

    bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0

  • SHA512

    cf44e168bd803f793bb60d984f2cbc177a00564d8872e0f8dac0b423d8f41b18958d23158e269db4509b2ede86d1462482e518821c4f3fac0ddffdec8d93b10e

  • SSDEEP

    1536:W7ZDpApYbWjIoPyPoLzV7c6ShZQ4PN54PNPw:6DWp4Wy

Score
9/10

Malware Config

Signatures

  • Renames multiple (3500) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe
    "C:\Users\Admin\AppData\Local\Temp\bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    94KB

    MD5

    22ce91de9d1c39c48bbdfd5d2e4ec628

    SHA1

    6adb08f732855ad3b516569563364fe7a6bf7d7d

    SHA256

    50b86f39a9bcf2d37dc17bdde7a4accf0c1632b9544f8ac863c0d2a40cf2e940

    SHA512

    0d7c2f6cbfced596afb42f19b9d9239f04b6190c176e03715eb29226aead1c1dd549672678f1552b73e904cfaa9658094be1c451eca74349a91c8b93423767dd

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    103KB

    MD5

    cd6bd2f9e3ebb23c273349c116855279

    SHA1

    527e4dc7c642123b39a8a383442bd2b6a485f55e

    SHA256

    6371921c4739467a3c0cfc34807e027c875269ba80b9828ce5e3670cf387e17d

    SHA512

    1974c85d59eed082ee37257c27da8e943084681b7909dde393864f60b2c597a39362155e46398db875122c666753c6170805dc602d67009f6b77dd89f05cd125