Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 12:59

General

  • Target

    3abf5108bd5e0e49a10ad7fcc82fee40N.exe

  • Size

    45KB

  • MD5

    3abf5108bd5e0e49a10ad7fcc82fee40

  • SHA1

    4e2e303c3022effa8be409641762f4ca6004a54a

  • SHA256

    8f3bf322c55f46f8665aead9ae0ec473dcbb91746447154b7d0a57ad641e9cdf

  • SHA512

    1853c977685af4ef4910ebdc3a961fefef96d91c2d6283620e9d672f0c2a44641d2bc2f327f44fd1293e6aefeecaf2b7d85abf4275a50ce54f6ad1d02812fab8

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1pjhOK3JjhOK3m:W7ZppApBULcfpHLcfpSo3fTj3Jj3m

Score
9/10

Malware Config

Signatures

  • Renames multiple (3319) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3abf5108bd5e0e49a10ad7fcc82fee40N.exe
    "C:\Users\Admin\AppData\Local\Temp\3abf5108bd5e0e49a10ad7fcc82fee40N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

    Filesize

    46KB

    MD5

    efbf96c28bc6996d4764ab76547ec427

    SHA1

    ab45afeda0f90baed216ae58f62d0beb2600fe87

    SHA256

    de0f17498cd7db8b5c1a6c4a7c3bae4c3fdc250fe36033ad225c2dd50eb42d5b

    SHA512

    8081cdd6a972f09ed51a7911e58a0ab696fcecd76e0816715092c10ee4537cc3f1451e32f801594c75d9c46a0d43643905fff7f13df2d34fb9af9a1d4cecf747

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    55KB

    MD5

    076023215043ad636067b0419f9f1b32

    SHA1

    a50128681d90f6bc8e53bada3832c53f5b02e4a7

    SHA256

    655a5f6b27ce50cf7566ef3a51ee3516af0dfe0e6d4320e6af5e9f2592bd854d

    SHA512

    d90ecc57cc2d211d82806956f66b06d6fdf9afb9a6ad0a3fcc74a0db164d3b1cb0548392ac87a17e38910b8af092052e9680ba98f74c85ee88cb840383580c10