Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 00:42

General

  • Target

    8d6a418aae438b8f1c02563789756580N.exe

  • Size

    47KB

  • MD5

    8d6a418aae438b8f1c02563789756580

  • SHA1

    1d76d09b6d973938adf4a4d02f36690abd78a2a3

  • SHA256

    c02e66a872fc1e131d97bcf038bb2026c69d0ef4571db77653911f65ad732e38

  • SHA512

    ac08974a75c6bea125cc959045e7d4fb568152656c9bddf8c3f884315e5304a311dfc25c53252383d9e7b2cc1a55f41a115fa59518ec74a6053752888e3e94b7

  • SSDEEP

    768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJsS1101XZQZZ:W7ZppApkFS/

Score
9/10

Malware Config

Signatures

  • Renames multiple (3335) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d6a418aae438b8f1c02563789756580N.exe
    "C:\Users\Admin\AppData\Local\Temp\8d6a418aae438b8f1c02563789756580N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

    Filesize

    48KB

    MD5

    d1b11cfda03a2eee433f98a061070625

    SHA1

    4e3c9806bd44a23912a2290c47c8650a122bd22d

    SHA256

    2bb67a0b2c3a8ccedd3e29fa259b93cee1e06b976c21046ffe078985a641f1ed

    SHA512

    5bb08a528a467bc5c5599fed1bfe6e5c479dfde967405529ae24ad3b6bb0447b9a0655b8b1cc98d5d75866a4a38065efba74472bb2f5614cfccf0d7ec5bdca1a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    57KB

    MD5

    76ef507c49db2ecb090437126571bc89

    SHA1

    efc86df31451b574834dde40390304cd03f6a87d

    SHA256

    db6e5066126d0650f0610ad7c26c213d8aa96dee220089e7b5371ca53272e75a

    SHA512

    87c7f446eb16f46a6abb148355be88dfd97fecfa6600fd879818555eb3ce19dfa3afd69b30f4d0ba985e7ccbc6644ddd4cd21ae4a6eefa0d9260cb40f9e69e70