Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 12:13

General

  • Target

    16b45b45007bee220d4d10bdb2c4c970N.exe

  • Size

    45KB

  • MD5

    16b45b45007bee220d4d10bdb2c4c970

  • SHA1

    9b7869b9a8de788645ee446687d205db92755273

  • SHA256

    30c724831ca9c4afff131a7c400546036a51b5eeb5b7b2c445e259ffc424f581

  • SHA512

    40fa6a5dcddc107c471df51d0c0f6931ba933dd5645ce0b7a1f37d6d14286ef1773a9cea132437bcd7e33c31c6e9885eecbeed01a6e972463856dbe7e6df4520

  • SSDEEP

    384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaI7:W7BlphA7pARFbhL801VvM801Vvv7GqS+

Score
9/10

Malware Config

Signatures

  • Renames multiple (3212) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\16b45b45007bee220d4d10bdb2c4c970N.exe
    "C:\Users\Admin\AppData\Local\Temp\16b45b45007bee220d4d10bdb2c4c970N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    b0147ddb59596b2b5fd7742c61f5cde1

    SHA1

    4d0c8fd57f6e9857a99cee018b91a42911d5beac

    SHA256

    745010706378d6adee318af5d23b8a01b8ea74746efd87aabea9e5a618c68074

    SHA512

    c409bbf63f38b012f54ff74032e7db16c5213b4d467cc9897f81c84032087fbff8d306aab2b0a51636176291e8796c31fecc7888b05993a7f1768317e5f37c51

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    54KB

    MD5

    90f96fc2d7d5fdcc4922c1ed4c4309ac

    SHA1

    95d794778c99519cf9bb62917540362c1120f3c6

    SHA256

    0cbf42dfc2bb18667a324b96645613295f1f4e6c6795fe9881817ebbf0f40040

    SHA512

    14d2dbb68379b28b6c6ca845f2aa8f37bedf7f185bb35e1ffc3e5c461f2d809031d41bc0e6ea685330fb0bfeb3e828e869c34da6e7f04a3b28ccc5a55a20f6b2