Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 14:37

General

  • Target

    3bac1e505e53a665629fb2a478dd8eb0N.exe

  • Size

    44KB

  • MD5

    3bac1e505e53a665629fb2a478dd8eb0

  • SHA1

    407471b68a5a45f70b0386cebe706caaa4b0276c

  • SHA256

    deda002460cf7b60496f9dce9d38f3787f373a4782ce75aeb482034ef72ba899

  • SHA512

    c2322e155810641115f79425bc7c765d6b31a789b50a8aacd3c2820c8611ff155ff5e55529fd91ce66fc15bf240f6c83064bee8eb7cf661045742563546e3e2f

  • SSDEEP

    384:GBt7Br5xjL9A7AgA71FbhvnwR/s4Nkq81LOyq81LOUqKqeUYyIl3yIj+NQKZX+NE:W7BlphA7pARFbhM0Kkq81LOyq81LOdoc

Score
9/10

Malware Config

Signatures

  • Renames multiple (3264) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bac1e505e53a665629fb2a478dd8eb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\3bac1e505e53a665629fb2a478dd8eb0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    dadc1e4bee90ee7f10bc796b0de4ec6f

    SHA1

    e8a62803b8c05f2b6cab9256fd16983d19478d3b

    SHA256

    fe3f159c7b5e279a362b1a0b1eae56a4377ad0866594175cf1d529399a028836

    SHA512

    ec11727218884a94a68104f53b2a751e3c7b7d7991789f813d9afc9efe8a0a25de1d61fe08bc3202ce819e0663ea994ac4a25bd841acb3532ba559db709bb700

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    54KB

    MD5

    de0947cf7e75c937fbc729e2625c231b

    SHA1

    b2c1d683e9805e5440775d2ceddb6914a66af941

    SHA256

    5b1bdbd2bd2ab4dfe08ce6755f9ab4f67b4cc76e8669a25231648c35b1cb13f5

    SHA512

    24b050e446fc092c6752350513f7034bcdc29f8771e841fb32cd92c73e9af2ed3fbbbcc8c9145e3eaa2380844bb4e958f104632006c207783f6a8ccd08eb23a1