Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 04:01

General

  • Target

    13864096e495143282a2f9d44e708d00N.exe

  • Size

    108KB

  • MD5

    13864096e495143282a2f9d44e708d00

  • SHA1

    b61f0710c90fa810b9ff60e1b8462e6be2641303

  • SHA256

    a0d59f4029184571c794be645cb96dfc940c3a1cddc4bd83f6e9ca7feb1450fc

  • SHA512

    14397143ba6de5dc8c58fe1a23220433c964ddd69dd371b0c9d385e707939275814c175d1ffb302784ca2659eb2e0a721795c1bad9248f72cc29627dcd80dc7c

  • SSDEEP

    3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBT:PqFF2Ie+efsim2k

Score
9/10

Malware Config

Signatures

  • Renames multiple (2952) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\13864096e495143282a2f9d44e708d00N.exe
    "C:\Users\Admin\AppData\Local\Temp\13864096e495143282a2f9d44e708d00N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

    Filesize

    108KB

    MD5

    7f428b5a829aeaf60456b64caa88e68d

    SHA1

    8f1d50750aef6fb8bdb4276255cb6cbd12ec4376

    SHA256

    40ff037143a8668005c4ed31dd6015b73825e147a6507075b4ab439d5bc2e94d

    SHA512

    179dec1b2b15f979d12cb873bd4ad77a44e6ff89269d233783353948127e747a81bfe3e02f68474b20bdcb5ae4db147addb1e6be4190e024ff1ad04d01cfa2eb

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    117KB

    MD5

    f14ffae6c23a384746043b07ca5fbdbd

    SHA1

    5192657face2b6697207d0fad0bb393fae802d29

    SHA256

    50eb28409627152d48eb094a38ae40bd9d00e818569fb0ede8b268e60feda740

    SHA512

    2f884c43e467a823d4ccaaa32c897ce11ecc3defa18ff2216eacdf1a99cc08f7cbbfef369b2e97ee05e58b0c3e78d9c94552dda3d1654d922afddde2af4d9e3e