Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 13:28

General

  • Target

    1ab67ef0aa79aa71ba91e12a4dcc8630N.exe

  • Size

    53KB

  • MD5

    1ab67ef0aa79aa71ba91e12a4dcc8630

  • SHA1

    68844f78d11fc651699d651f832d369149b1fdf8

  • SHA256

    2eaa3d653c3e7ff3f045abad56088ffde45d5ea7241e33b34662e5bca6c2e004

  • SHA512

    657222793c942fd9eb933b856123b4b386d442ed2eedc32cdc25229864d60d5cd18ba4b55380b131094e864817c2bcd633823b2013749818a9151c7c6705846d

  • SSDEEP

    1536:W7Z2sspAp5YSfffdOP+UDpOP+UDunAQanAQf:62ssWpYXYX3

Score
9/10

Malware Config

Signatures

  • Renames multiple (3293) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
    "C:\Users\Admin\AppData\Local\Temp\1ab67ef0aa79aa71ba91e12a4dcc8630N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

    Filesize

    53KB

    MD5

    02c45b622bbff23c2e4d2a69ec2ebe23

    SHA1

    c306ed4bab84f78e73bac602fe4c7bd69f172602

    SHA256

    369ae1bd51f8f5cb0233df9e615cb876b00dfe72615e3d0e2358762f20c7f586

    SHA512

    20ebb0f81f29e653695d9f0056d3ec68c1cab9fe8649e069e831852cc27e6ac0a337d0ef20008052e516c8501b788043756a330bf79bdadd38b604e7c819c7eb

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    62KB

    MD5

    feb51b25392416b55a0d358ddb8644d0

    SHA1

    0239dda05c6c8eda5e90c1ea4147db43b7e2cd4f

    SHA256

    281b139272ef6dc1a711aaa80652959c3a9d40ed5419d8d62c906baf65dd8ff3

    SHA512

    1338a14d75aa2dcd3efb07b43931b7ad822bb89060c4f366721f1a8f065dfb668f683788be42c47a0423f9b041878cebd134c3fb5adbf47aa68b39d228bf2437