Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 03:24

General

  • Target

    d50fb6fb3fb1bcca64738ee37474a903786296f3d8db7ff4aff51e6931451957.exe

  • Size

    53KB

  • MD5

    fc577bc87eb8893512dbef14a5b8cb13

  • SHA1

    2d37e56c6c9f2fab5f114e50f00b4b267a77db53

  • SHA256

    d50fb6fb3fb1bcca64738ee37474a903786296f3d8db7ff4aff51e6931451957

  • SHA512

    4893aa7a102c2cb13de6dd36398408e64333306710530988d273db7a50852ea0954df74e47107e9b9573af5d66703b6a5dbaae37741e4b51b04ae16068aad3dd

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLh4PCs2B24PCs2BKw5:W7ZppApBULcfpHLcfpyD+4PN54PNdw5

Score
9/10

Malware Config

Signatures

  • Renames multiple (3737) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d50fb6fb3fb1bcca64738ee37474a903786296f3d8db7ff4aff51e6931451957.exe
    "C:\Users\Admin\AppData\Local\Temp\d50fb6fb3fb1bcca64738ee37474a903786296f3d8db7ff4aff51e6931451957.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

    Filesize

    54KB

    MD5

    69495d2668ac714ad5173df83c96ea89

    SHA1

    e931a2438050988a4c6c3724258ae81d5452cdf2

    SHA256

    9a7671f0d00c618f7a24f0d04b746bb5f67fdb4b5b3e1fa30a1197f58ab47a2e

    SHA512

    3b4edba835584757811c5dc9516c4114dea4bbca9f9dca0a2cdf607e378af592d650157214b37de4b8dd72caa82cd9c1a43b6fab5ae1225985ce4331c02899a2

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    62KB

    MD5

    57a27426c552a13ed63c8f686b699260

    SHA1

    8ad80e767d6657d01d8267bf432f1238a8a78b55

    SHA256

    0dd0cb16ad64abfb9b3ca13b0ff7b91358fd2f15499f54e4ac7d51b4cecd1cdd

    SHA512

    37bafef7fbe2b84eefb8235626a51c4e08ef2feffe2f682320fef7875fc7d7b90ea206030973b988a44fbdebf6e0da2f1c960ca2fd7e3f71ed607a5f082cc53d