Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 14:53

General

  • Target

    9afd6808c05514f158a9ca78d653a150N.exe

  • Size

    50KB

  • MD5

    9afd6808c05514f158a9ca78d653a150

  • SHA1

    7ce5b5b91b49d22008a38ba576c19ba52e538807

  • SHA256

    8336166f39a76ddf04182b003b78955047b80d5e17d105379fa4022c8db1b42e

  • SHA512

    2e5eed177ee2ca8582d35c65f297b1864eca044bf5399ada8bc093aed31611f5884f30865698e6fc160a8e8c8f790cda164dd11500c1644be7de8107798f71b2

  • SSDEEP

    768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyfxAkJhxAkJ/1PQurQmi1x7urQmi1xY:W7ZppApyVyjVyUosPosk

Score
9/10

Malware Config

Signatures

  • Renames multiple (3140) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9afd6808c05514f158a9ca78d653a150N.exe
    "C:\Users\Admin\AppData\Local\Temp\9afd6808c05514f158a9ca78d653a150N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

    Filesize

    50KB

    MD5

    3519cb34361eeabd5675d7cb74b98184

    SHA1

    aa9077675611a4939e88854f4a69fdb389a701f5

    SHA256

    90a78e836405912e695414e5e86f666390fa85f8f2502afc64d171614ee4072e

    SHA512

    0d517d4ff4134d9e98bd037352be71596f10d4e834e425862097d76b47b064e1ca0fe03fbf6447d0ce91acb924a93f257618f62aacd15279747999b7b832b354

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    59KB

    MD5

    1820afec320e94df594dcc2a549c25e7

    SHA1

    17c4da69711dca9fbfb3744c418ae358a34ff85f

    SHA256

    aff45426a7c32936957d17d12ee41c65f1a3c946e1da2b89ec405036b3362c2d

    SHA512

    a16a102afe4a1af50d98b1385fc01555b6b63da1647c52ba4990da443df5f0fd8ea71336ef1b45bbe6c9895473c58da22abc82fc771ef1538ae925761b314e48