Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 04:44

General

  • Target

    afb1e1d1244e6bc17ac709ee406eb310N.exe

  • Size

    38KB

  • MD5

    afb1e1d1244e6bc17ac709ee406eb310

  • SHA1

    501657d64f890087a6d4a153d8df1281608fd7e2

  • SHA256

    ead8be57c4955cde1559e1dd09aa44461256164bad8496203358bfeb5e4ff169

  • SHA512

    385a0fc7bda5f10be9e93bd3582cbaa6057427aa28db947714655ce3f03426dd653d527b27d0adf68c6daf1b48ca508c3e1a9c6cf4d24ff82e18f0fbfc40165d

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42LcfproFNF9:W7ZppApBULcfpHLcfpyD9

Score
9/10

Malware Config

Signatures

  • Renames multiple (3455) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\afb1e1d1244e6bc17ac709ee406eb310N.exe
    "C:\Users\Admin\AppData\Local\Temp\afb1e1d1244e6bc17ac709ee406eb310N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

    Filesize

    38KB

    MD5

    7fc48b74cd3130d7374924dc7b38e450

    SHA1

    d866d570143eb52bc2bf4a7b9f6946de374883a8

    SHA256

    30d6be85e73cd38c8500f11ff501ef21397d7fe9b155c52efdce8fed6f9419ba

    SHA512

    2fedfa1e1b0bb9cd7e97ff3d0181858cf44e188da5474a092bfb3d8c3dabc68c5038c4f09d783b454b5636c062e6c5f423fa6c0a832dec23407636f472213eab

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    47KB

    MD5

    4e59972a975639a483fd096575c8384a

    SHA1

    8b2bcf82ebd6b6ef5c15c9735b1fa777608cd5af

    SHA256

    8dc91a349a58aa2f88c787e67a6f854340796ac75c999488fb3fd4516ea21de1

    SHA512

    abce3559c38727e077ec55fcaceca74a420570692a90f3ff222cf32d493fe4268b73a066c7069d13506649fd75241b97ba465e33f27daa740e2819cacf8dd9cc