Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2024, 01:25

General

  • Target

    a71ae9e067e55e380bcf93954b8ef42d06ffc411cde649530bb74dd67e8317b9.exe

  • Size

    90KB

  • MD5

    89b5186442eda1f087db738f3f52afa0

  • SHA1

    6fb1de34a72e454fe86fa4c8c6f6e9dbb2fa3e31

  • SHA256

    a71ae9e067e55e380bcf93954b8ef42d06ffc411cde649530bb74dd67e8317b9

  • SHA512

    99d37bd7a90324cb1f8e4687fe094f4ff1e84fdcf72d3eaabe4c61ae1a2abe0969e665e03436746332f0bbcad2b0542a0d12fdc7394f865791ebf5a64c8e125a

  • SSDEEP

    1536:W7ZhA7pApH9QHwtRF9qaRjvmujvmRzqzlmJgwmJg/SL:6e7WpHIyRF9041q6

Score
9/10

Malware Config

Signatures

  • Renames multiple (3467) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a71ae9e067e55e380bcf93954b8ef42d06ffc411cde649530bb74dd67e8317b9.exe
    "C:\Users\Admin\AppData\Local\Temp\a71ae9e067e55e380bcf93954b8ef42d06ffc411cde649530bb74dd67e8317b9.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1496

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

    Filesize

    90KB

    MD5

    9378d221b40a0cc3b9ba9ccaeec8e53f

    SHA1

    7f12f253f2d8ad63c64c2d39599ea400ad0f00b1

    SHA256

    2184a67396a0f6fb762f168aa37a9265ee3f7f423f8dc746ee3db805a404b61f

    SHA512

    65d12b10071757fc7ff23b94f0525f852710a6e5fb6f8b82d67b5ccc4ef6eb24647108a438c3e5dcdbe15b046db6c0854c5e8f545b1482f7b55a163c002f0c07

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    99KB

    MD5

    7f699a2ccc3c23baefd0b90461d4cde3

    SHA1

    66b45008f3eb0874bc244a5a8dda96dfde4c407a

    SHA256

    2b627eb5cad6d999f52e581de509e8f8dea7bf0e2cddcf7b356b2b6e0d814ad0

    SHA512

    f9a66be7a014849dcf851ad8665f2c6de569accaa53b7b6e99f13898ff94ae11eaeb36b52e96d38860d6bcc037fa20e3d1073b0c93d3041f96a35e863c7553a9