Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 06:39

General

  • Target

    e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe

  • Size

    42KB

  • MD5

    47ca3e27df241b211eaf42bc68ce681a

  • SHA1

    2a233f6f4d8bfdfa1355e4dbb23b679145f72ea5

  • SHA256

    e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0

  • SHA512

    f5fd2aaca24cafe775f3ae4c5d4699e1a756357a217b2e56e952f040e4f1b090499d7d90fb21ee4c6c552460d182ed92f20068fbb846211eeda2742f28fc5f9c

  • SSDEEP

    384:yBs7Br5xjL8AgA71Fbhv/FzzwzDojo4jZj8:/7BlpQpARFbhNIDojop

Score
9/10

Malware Config

Signatures

  • Renames multiple (3776) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe
    "C:\Users\Admin\AppData\Local\Temp\e787f703d877b9aa0c7724fcc5d6d996c0c152f0e553e22d1e6c61429b1178f0.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

    Filesize

    42KB

    MD5

    82487ec63295fbfd8f547a1dc38fb640

    SHA1

    17ae2d71bbd893e254270a0dc18c687aa8f92dc6

    SHA256

    9bfb1394766dcdf4117898f7aee6de0adbc1a0e711f8bdafe98bec6c61322e1b

    SHA512

    f6d3508e51da45d78b9b3401c9788739fae0379d54edc15ad97ee7fd0252c65f6d9219da40a82ac764414c953b78f013014b47b733b6baeaba24e814c3b30357

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    51KB

    MD5

    f4f93a4e78f4986517abe97a4f30b1a0

    SHA1

    bb66f397167b08eeb0a457541de7ac9830ccf32b

    SHA256

    b2be0b9a82466723fd32fb4a88a07af3e5c74944a403f06a22e88e4cf2fa7549

    SHA512

    f2389ec04822fe05925c475e922e069f47b8dbc234a71c5ab32c5d87e40e3cd0862a3d8207c9d746f982c6358170224aa5f277e080dc37cf93b2742cd369e597

  • memory/2988-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2988-74-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB