Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13/08/2024, 18:22

General

  • Target

    e36f21fffa150e265b117f4414904920N.exe

  • Size

    108KB

  • MD5

    e36f21fffa150e265b117f4414904920

  • SHA1

    91ac2f61116a04a8d6c96487dddc0eb1c76ae7dd

  • SHA256

    4da8097d30de018927b5e67d5b34b086a04752c0120d17b738ddaf47831f91b1

  • SHA512

    069fbfe1b7467fc9e76c429a6e101ff10325acc76c3216791b957771cbe63e868ff266891fe2ab38b48dd44c669452d067f92a21aea14e80e806a28b4d2f8735

  • SSDEEP

    1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8z3ML9p5:6DWpwE7oL2e+efZwZ08i8z3MLR

Score
9/10

Malware Config

Signatures

  • Renames multiple (2933) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e36f21fffa150e265b117f4414904920N.exe
    "C:\Users\Admin\AppData\Local\Temp\e36f21fffa150e265b117f4414904920N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

    Filesize

    109KB

    MD5

    752ca78917bb1039fd1b5fe441059d19

    SHA1

    a9f33a6f51e5e526f5d6dce4531b61f9f0985b62

    SHA256

    5d1925323934a60ea2e8d01c20d9ffbfd47fba11570edd3705682016d6672b1e

    SHA512

    04da39652b34f11b052b0216df9fb25a0e1bbef02d568d71278f438a1228a4288b4ade9437e731243a651b7976495dc9f8557d374c4202d693c0f8f51d62c7f4

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    117KB

    MD5

    f1d6d4d398324eaea224020a44fa2102

    SHA1

    f2bfbb9db78441dcc00e62fdb9b0d1af729d4b00

    SHA256

    2a1f7e96fc1e0f1936cb6559badedbba652ab8e170502ee0db6abd32122bfb07

    SHA512

    75c2ed282131275ec64510bf824dea3f7dcc0506792054e0d3e96117c5c353517569d40fd7f06017ed111da5a1b58ad4c2610dd43672cbed325e07bf57871f0a