Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/08/2024, 17:35

General

  • Target

    06d06ad7598dd5168e91c3221623b1f0N.exe

  • Size

    96KB

  • MD5

    06d06ad7598dd5168e91c3221623b1f0

  • SHA1

    669b39092e9ff6099f07e88501ae47018bacb72a

  • SHA256

    1c20cbfd09cfde29d7a28f1f67957be0c1dd37aed1f4f0db014762c6af0422b1

  • SHA512

    66a135af6230e6afdedcd6815ffba69327d48e53781603707db0999bf784d4f0ca4ddc034540f874ba6c9e899ee90df544a82b3f7f3e6653e372122565ec653a

  • SSDEEP

    3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBe:PqFF2Ie+efsLK

Score
9/10

Malware Config

Signatures

  • Renames multiple (3141) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\06d06ad7598dd5168e91c3221623b1f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\06d06ad7598dd5168e91c3221623b1f0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    96KB

    MD5

    e6c30d98ab35cca543ca853b76de9f21

    SHA1

    432ce63fecfa3ab909fc8b33c60f305fbe306b43

    SHA256

    b0a19ddbd183583a744b9b598b5ca72481f10c68a7019c9a18c145e8f9be2db8

    SHA512

    350071548153c2f081e3858bc7d429e3f876987bc11700b437704b78fc7c362a2d48c8f2d4c975005ffdac0f387ef8b74b7cd5c26c718ea293fbcdea725a805c

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    105KB

    MD5

    56736cd20de6b5555f2cbb8b15dd5ef1

    SHA1

    99ae1e7ba0df4f9ced8fcd8e1358d01905f86c14

    SHA256

    bcd91aca4de704cf9266cb047c9d160c3658446b2e55adea8db5e9a366184d23

    SHA512

    8086481e5dd9a47463ea4caec23495878e4a5e3f383eb0f259e6f0437ced4a51c1b8c3b35bd7e490706d546e22860793357a104d6164a1b03d78335772e0af5d