Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 15:09

General

  • Target

    0d453e6b496a4b0423ca3dfe35f8db30N.exe

  • Size

    82KB

  • MD5

    0d453e6b496a4b0423ca3dfe35f8db30

  • SHA1

    467efd3743fb01cb289051a7832561a4ab7d9f26

  • SHA256

    2519c07529058d148aae53c7baea8980c1805f51cbc5c541f1c799fc9f0061c0

  • SHA512

    0c697fd1e43d1d798e27f61f9b69b511307b71ff2e43756f5088dea2d99eabc0dc48ff8f263f6a173e7e29aa671de2120a7b51af4921b5be3322fa5c955ae63f

  • SSDEEP

    1536:W7ZDpApYbWjIoPyPoLzV7c6ShWfxRfxC2R2f:6DWpLf7fU2R2f

Score
9/10

Malware Config

Signatures

  • Renames multiple (2885) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d453e6b496a4b0423ca3dfe35f8db30N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d453e6b496a4b0423ca3dfe35f8db30N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    82KB

    MD5

    9f673ab701ff900871c5f700587760c5

    SHA1

    042ebe75b75308ae8a20939384751f2120875289

    SHA256

    df534fb03516499151e3be19ab3b07ad7812f4319543e6ee300701a7d0641a0b

    SHA512

    a550d549e14b41532196106aff432b1b64fecbf953b313355d2faf008e16c38264c032fa0724000ac2b3b5267873f09b09ca386d7bd268fa5f7abf33fca9e30a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    91KB

    MD5

    bb65cb749bffd4fc8952b3a8184aaa9e

    SHA1

    2be48817a0f2cec39c017c7a1c7ea72ab1cae49b

    SHA256

    9a7a65ce7d0d0109af74642b801d62c3e1114b71cf78c714159723cf01ad991d

    SHA512

    ae4ecd2c4c48b23e2a2149b4a6100c6a7971986aa17a012f81ad86930f4805a38b9e5cd43da2f92a8c8f123af358f0c0ae85c067399e2ea5a66c362756abed56