Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 21:34

General

  • Target

    7616b0ee50d8e7c66787785d9666c4d0N.exe

  • Size

    44KB

  • MD5

    7616b0ee50d8e7c66787785d9666c4d0

  • SHA1

    781ec1a6562260f5736edb7d33097e262644f9f8

  • SHA256

    e553768f6864c8677e954370ba60e2782e63fd9be4e52a04bae03c72b90eef5c

  • SHA512

    20d4a6a27341157ebcd1f43ff52b7fae653ccdf60094195063c58b7e287e3466cfd44ed80c40ade9f56389b9a6cfa2433bc7f04df7c47ced9937eab84a486933

  • SSDEEP

    384:yBs7Br5xjL8AgA71FbhvPvD4Qfxd4QfxlQoVeDQoVes:/7BlpQpARFbh3vzfxRfxlQoVeDQoVes

Score
9/10

Malware Config

Signatures

  • Renames multiple (3260) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7616b0ee50d8e7c66787785d9666c4d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\7616b0ee50d8e7c66787785d9666c4d0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

    Filesize

    44KB

    MD5

    64a07ac9d3420932e6b2e05b0cf2f549

    SHA1

    13cf94671fa1264c8b56f236596e52c4c6eff2e8

    SHA256

    83d38061268cff6159277fe76a6902086afc48164a5b9cf97d76b36c82285def

    SHA512

    287e0d2e8bb83078175ee0ec990344611ad295c0068a685e60249a655cdd42660e939b3a899987b39569391e35aaae73be3ab6d48b562ba5563f756991ea1551

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    53KB

    MD5

    087dd898d2e5d83fe406e2eddbcb11ea

    SHA1

    0011faeb89ba5c44e9ffacde84ea2a2bc1169fb5

    SHA256

    e25127aa13396e93b5fe145656c2def1317af951c55582ce9f11dfeb9cbe4909

    SHA512

    a7f23ea015ffc3680025bdf83191daaf7b14f6a88c9c62cbbe0decc18cfa06372904ac56811448574b03b342414927d0dc0e57ede4e4f21786116e31c2c82468

  • memory/1020-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1020-70-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB