Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 21:11

General

  • Target

    83db1095afd3f7dae51b2f7db317dc20N.exe

  • Size

    46KB

  • MD5

    83db1095afd3f7dae51b2f7db317dc20

  • SHA1

    5d217994b95c4c765cd2e5e632364a1ccd2986c6

  • SHA256

    4ab318d8af667020164b8656ea6c8808bc8e7f176193a10ede6dfd21b0857d4f

  • SHA512

    96539f1df3f9eb585cdc340e4b53c49851d136b2d4b66e322f22c88e52b848942f12bc713fe09d7641496c337f32ab51a0dc901b1f0e8cc6157574bad0608aa8

  • SSDEEP

    384:GBt7Br5xjLdbAAgA71FbhvU8g0U0fLMzyKbNzzyKbNWkq3DLXakq3DLXGbg142NW:W7Blp+pARFbhBgnKLMWK9WKD2N2w

Score
9/10

Malware Config

Signatures

  • Renames multiple (3339) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\83db1095afd3f7dae51b2f7db317dc20N.exe
    "C:\Users\Admin\AppData\Local\Temp\83db1095afd3f7dae51b2f7db317dc20N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

    Filesize

    46KB

    MD5

    4e221de9bcc409f8394158e526c3da11

    SHA1

    06890536a5846441c6361a3d7adc2333718faad2

    SHA256

    b10e0097fdaf3c957d6d5b159c6e2a97991a8297f4aff4b96b1f96b380034a74

    SHA512

    a4ed457cb413b57fbdc6678989fd377221a75081c4f3b98dbe2f08cccfb9ee13ce1cc0af2edf5bc1727627b49dfa103273354b6b35c7d3cdc98ef6ce35a93942

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    55KB

    MD5

    70b3d63076aaca61ed6fea0694026691

    SHA1

    076ee82a5cea18b64a63650f822f87f9c09a77d5

    SHA256

    97d9b96b3e83e02c4379795bc683f20dcc75787b73e51ef4dcbaa971088dc1bc

    SHA512

    0fb9ef6dfa050801029b08530c001040cbd2549fb5d1c0f26bf750af40e6024ebaaa667bf466a49d77a695ca818df6fb94617fafac650193eec2ad817fc15010