Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 11:07

General

  • Target

    b0c85c32c74151c2ca025d4fd81a4240N.exe

  • Size

    42KB

  • MD5

    b0c85c32c74151c2ca025d4fd81a4240

  • SHA1

    65b70a5a7116e1ff90142b17d701c0484f5552ea

  • SHA256

    97a392f6aa03c518d3e81c3da4f1b8540d32fddbb8122f82257e20dcd88fc818

  • SHA512

    9f9f1b2be939b0e482bf922e4a7f6e0d58d599ccfd9e828d4c70cac6ed7571ace4ce89cf4913bf6ced4192196085f1ca44042b8092f0ec196d5f2b0d9c99a5bd

  • SSDEEP

    384:GBt7Br5xjL9AgA71Fbhv7bhvZ11F1NE7/Ez:W7BlpppARFbhjbhT1F1D

Score
9/10

Malware Config

Signatures

  • Renames multiple (3188) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0c85c32c74151c2ca025d4fd81a4240N.exe
    "C:\Users\Admin\AppData\Local\Temp\b0c85c32c74151c2ca025d4fd81a4240N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

    Filesize

    42KB

    MD5

    0e392b165a96ec321c7311ed6e9df52d

    SHA1

    91dbb08d245f269494f387243f7861fd2b851539

    SHA256

    c7253959ef744623cf518dacb7510169761a50eac2996d4334a4d494b60773e6

    SHA512

    3c0a57bf322db742515a2366e9dcfd8422b2396eac175e86521a7ea51752320b4e33984f40eaf6fdad94cac622ce788cd2b690211365ef196628bf9a3c017afc

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    51KB

    MD5

    1def35673624302daa4e070355f0fa3e

    SHA1

    e62343d34fecf1982e10d6e0c08a4514c3ced998

    SHA256

    38b18531a5b16bca2f093466360b7332655e57a0a78991bcfe54e3db16788fb0

    SHA512

    1281dacb3d76ffa4ce34c4eb2e76ba1f2af9eebf71658cd2e6e3a088926d3b87f7503d68bb5f8a1e60915ecf0a8f549587adea184b9b449573c3c02566217ef1