Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 19:12

General

  • Target

    83a6ee3579f838b867bffadf9c531b80N.exe

  • Size

    69KB

  • MD5

    83a6ee3579f838b867bffadf9c531b80

  • SHA1

    bc879cf071dfa0133d94cb87db22287b13f7742c

  • SHA256

    7a71bf819fac885e6fdaa50f305c20270a9ee7da078d69f81aa48f4e1e18895d

  • SHA512

    b574196a4a741f72b856a79a443f6ac83d46e68251151569790534793542f42070674e5097b6d6f407caf5b72ee8d6af04961560b890ccd2669b9293d08ad385

  • SSDEEP

    1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8aPtPfgNP:62ssWpcU7lK1lKgkEgNP

Score
9/10

Malware Config

Signatures

  • Renames multiple (3117) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\83a6ee3579f838b867bffadf9c531b80N.exe
    "C:\Users\Admin\AppData\Local\Temp\83a6ee3579f838b867bffadf9c531b80N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

    Filesize

    70KB

    MD5

    8bca4abd3e78689ed84f10a640566822

    SHA1

    de2f7de6c49c090ad55a2e5593df8ecaa1935572

    SHA256

    c367a4d807e69f8a545a033f4c68eee0bf1f72031e33d6491712cab6113ead6b

    SHA512

    aa4837e377909dff37ee6aa843084a387422e13ab384ae356621324b7ee85ad9c9125eeb8fa1c99347ff560ffcd944d12ae6a5455704af0ac0f6917da108bf1c

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    78KB

    MD5

    f524865f2c24e993279cf9a5b8e350dc

    SHA1

    771e6d21dd57cbaf27be3dd5ac8c8b7dc91fe016

    SHA256

    376a4201f0f36e142cb46abf2a046a11f708e4df5f16154fe5b9ed12e7e32277

    SHA512

    8ae47aeafdf7669cc40562ba7bebaf7e9aad3378f35138ad5512c57f70a0e63974737d2b270bb76223d025853022859c098f5e5c82851d662738f7af39b1ec3b