Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    28/08/2024, 20:32

General

  • Target

    c6932bbb479df23f84056149158a6bf0N.exe

  • Size

    49KB

  • MD5

    c6932bbb479df23f84056149158a6bf0

  • SHA1

    9a66bdcd113c4ef4a06bd633de388aef42b47ce0

  • SHA256

    321e9bfd4e98d30e149e04ab20efd7870dc3088162f39b915a05a5909a21f715

  • SHA512

    d21e534a179023bccf32a0163683a25b9998c073daf4ccd1fb09583ca84800333cf1715ea59ed92ab11e74185f0e61e4c840c1a44c30e221adeb9e69de0403bd

  • SSDEEP

    384:yBs7Br5xjL8AgA71FbhvtzyKbNzzyKbNrwBBgwBBQ7xmDNZ87xmDNZZ:/7BlpQpARFbh1WK9WKzxYbMxYbZ

Score
9/10

Malware Config

Signatures

  • Renames multiple (3180) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6932bbb479df23f84056149158a6bf0N.exe
    "C:\Users\Admin\AppData\Local\Temp\c6932bbb479df23f84056149158a6bf0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

    Filesize

    49KB

    MD5

    a1d6b4ad5ac1114fb387ae33b07765f2

    SHA1

    35a1b2810a8477c5aaddd2f7b2df089bf197967d

    SHA256

    23b0428a3d3bf2a016b153fb9a1163ef55b07e3cb07b98a6f39a74fc21aa511d

    SHA512

    2fe420640aaf63650c5dd42dd3d17ef35e68bf81979758ad5b0542bd3bda096a3db3eff328fe8e9e1bac5296a494f6d36df41c2a96f3194bf16e18dc7424a384

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    58KB

    MD5

    5c014edd959ae6facab735eea26cea54

    SHA1

    75360e84e5b1488015f892695e1e087b4fc74ccf

    SHA256

    03abac077d1ebdab25c790ee63323864da25e026053b93703c5a71f273bb3266

    SHA512

    b50263ca5ee31387d52787d000fb8739a8f25f320cba61d5b5f08bcdc2f7515c3dcc21149db01d580413fc8b4cdd010234e8ff96f8d1a67aa565e239300c6a43

  • memory/2724-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2724-74-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB