Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 01:21

General

  • Target

    fbae888d18e683872a091e6006306450N.exe

  • Size

    73KB

  • MD5

    fbae888d18e683872a091e6006306450

  • SHA1

    0f7d842238012a1b5590c6986c6526785a5ca7e7

  • SHA256

    3e7ac9bcdfa03e34692d5dd390d2a2ffb9b032b21b1359622c21abc72a93683a

  • SHA512

    143145352ad05ac2b1f900d0980f34b52b3f7919e554e00cb23f26b56aa62dfb0fe88a0ff723612b774caa3756400ff72c481d46b6eeda15a52b36fc4e39a6ac

  • SSDEEP

    768:W7Blp2sspARFbhJpupZ5pZ4+fTgTvlK1lK6RZR+8/8gClurYClurUpOpLqfqY:W7Z2sspApkZrZ4+fU7lK1lKT8/82CY

Score
9/10

Malware Config

Signatures

  • Renames multiple (331) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fbae888d18e683872a091e6006306450N.exe
    "C:\Users\Admin\AppData\Local\Temp\fbae888d18e683872a091e6006306450N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

    Filesize

    73KB

    MD5

    548ad92d22f23ef80de4b3c0acd31e81

    SHA1

    4a5034df0e3ff0680bd93bfcba8d6d7d8f7db81a

    SHA256

    e3531ffd75a89296354727805b5459b46b5f0de2b45f27f3149aa0a1160cfe93

    SHA512

    3e24ebb6ff7e0939e02f8a6c3ec1a3ba7e375f2e6b3f014d6ebcee09d59304fa84acd25cb1ade2b29ad7c80ad4e585df422dfa8b0580b991285a3d3276d85625

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    82KB

    MD5

    0ecdf6882e251135c6a775d825e4a5cb

    SHA1

    1420bbe7c82ce5754db35605b806eeecec88fcc4

    SHA256

    9a30121b193e4eb6b5a6102484b532258fc06e35fd0ccf8e317a3c273f0f3890

    SHA512

    b202651d703a9a3cc8896c484fcc25def11e1b3ce4ec93c90babd2fd2863fb07c35c10e4410e3a13536b73675163137a295537c60c2020b7c90a5c3ec002c0b8