Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 10:37

General

  • Target

    a0a7b0c37e61e7b9a63b4fa2bc091820N.exe

  • Size

    77KB

  • MD5

    a0a7b0c37e61e7b9a63b4fa2bc091820

  • SHA1

    703c16cc97564c898b9b0fceaa96dfee4dc3b711

  • SHA256

    bb4d3122949f0de622d3d8cbc4fabd7c16c92f6a32fcd69e709117449f781668

  • SHA512

    3d914ef362f3c771eb8b93e4c7121107e6acd7b8ab0a409b0817aa065bfb081672583412a0c620e8a864c09b3601e94a09541cbc205ecc382049822539ec6fa1

  • SSDEEP

    1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8Ue+bCeh:Te76WQSotbCeh

Score
9/10

Malware Config

Signatures

  • Renames multiple (3162) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0a7b0c37e61e7b9a63b4fa2bc091820N.exe
    "C:\Users\Admin\AppData\Local\Temp\a0a7b0c37e61e7b9a63b4fa2bc091820N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    77KB

    MD5

    ecb2a4ef6055ff2accf699cec8ecbd12

    SHA1

    a7d5b23c2676f8ba02d7eae60765573ab92f4866

    SHA256

    17506eaa82e3452e0f0b51adc31979cf313a20c99e87ad4fca80cf92d44a7a49

    SHA512

    66a0f0f63c5f21ca95f146ebbeadf232094dc2edd76deca785b7f4884ef1eb148df3f45bbffa863d3fa3d3dcd1bf115eafbf74e7935d3f1d2add827e2e44e366

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    86KB

    MD5

    41ab7d31c06c3b67b0534b7befec89f3

    SHA1

    f45bd2eb1bf4e11ac4a705aaa80e35cb7cc3bf30

    SHA256

    b734805ccaed21ceba88d0445fe962da71f462ac53636926002d983850929055

    SHA512

    da5efc1bf1668d395813e114cff5c77df6bf0b5f7d516eadb022ad875de0a56cbd842eb64874a99558ab4285ea3960347248e4e364ca4f9a9010ffab656f1f1c