Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

19/08/2024, 01:17

240819-bnc4rswcqg 9

19/08/2024, 01:14

240819-blngqaygpm 9

19/08/2024, 01:10

240819-bjw13swaqc 9

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 01:17

General

  • Target

    4b314081bcb5531e368729bd169b6520N.exe

  • Size

    76KB

  • MD5

    4b314081bcb5531e368729bd169b6520

  • SHA1

    26a334cba2d2873df0fd811dba841622208af408

  • SHA256

    5483aadefaa81c09f0fe892527ff0003aadf557f64a0fcf5486618e80130abfe

  • SHA512

    3a390a26faade5c9b2efb19dba187941ed28faba4b3ae74513ef27a7f68f4a3a756e7a0459072834ddd53869bcf5dcc58e042a685e71171ed50bdfd56466274c

  • SSDEEP

    768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEd:/7ZQpApze+eJfFpsJOfFpsJ5DL

Score
9/10

Malware Config

Signatures

  • Renames multiple (1026) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b314081bcb5531e368729bd169b6520N.exe
    "C:\Users\Admin\AppData\Local\Temp\4b314081bcb5531e368729bd169b6520N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

    Filesize

    76KB

    MD5

    0d5fba0ab72b6d507bdac8784997e8fb

    SHA1

    bbbc48c9c9b5dcedcb7bbcb811d139a882e38d57

    SHA256

    0dd5a8fb559b0ba904e8398474fa56711f8c22c405c934afbb32829bdc5d28eb

    SHA512

    e398cde12f096bd047a32cb75058219cee1284c5cb50717cf7edd1760bd09ad805e68e98fe8aad966224dc1b24b9fc62181c2f623a35fb3188800062b4b9869a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    85KB

    MD5

    a3945b544867b968c851944843149abc

    SHA1

    e06fa3d80be60dae4dac221afbbb3791e5800ad8

    SHA256

    bec3e66cc95970ea4edf1cbd7da4cb6e74b518f4287bc055ec80082d334ce748

    SHA512

    c87082e71b6c90fe8c1c98d9ce8c8d63d3277e6f4eff2f3cc45c4505edb61a8018ba787c06f704ddfe6491c8103000f5449a3fa11b127c9c106322cf7f37c07e

  • memory/1908-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1908-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB