Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 21:23

General

  • Target

    1908e6a381f4cb24aead7ab8f76567e0N.exe

  • Size

    35KB

  • MD5

    1908e6a381f4cb24aead7ab8f76567e0

  • SHA1

    0e0f2399cb56797c04ec5fe281c6d605b7883a64

  • SHA256

    1ca874f0f1b6a451777e342b1376e64d84e2a6f794ce6a7401f05b52db57c067

  • SHA512

    1ba3cb4664ddb6bf72404838a1d67349a51c93bc06f22de890208eb449e7af163da117d7d6694e494a8773c84b6ea53670d146cfc4e5ac54c490cb661ed99d96

  • SSDEEP

    384:GBt7Br5xjLfAgA71FbhvtPci1lnYOzlnYO5+vu+vn:W7BlpDpARFbhzbYONYOktP

Score
9/10

Malware Config

Signatures

  • Renames multiple (3249) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1908e6a381f4cb24aead7ab8f76567e0N.exe
    "C:\Users\Admin\AppData\Local\Temp\1908e6a381f4cb24aead7ab8f76567e0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

    Filesize

    35KB

    MD5

    3d8103f0794097cb2c7af37aa8a736b1

    SHA1

    d57ed6279afbcc05a713566d1182d53216a9653f

    SHA256

    e2a1f54762767460c37b8d79fc910cfec6b845a36ed72f058cd41e2edcfd6b58

    SHA512

    15d82f277c6e2b3ffa62ee8164517d51d63b1d00c0948b9f1e325f0996142f918d978d883c61cf1d614cf8ab4389c7b3bad41e1f07b7620e59ac4e41bba5c046

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    44KB

    MD5

    fdafff4d849bbbdc07bf7f0770464714

    SHA1

    bb8a017d1fb7d3ad112ff5654068b8ac251a9c9f

    SHA256

    9a2e4373de177d00b1de255adf0d7a7ef772165dcb47935684e29e61c403ba73

    SHA512

    2af874c62af888873eb764b422cd2372736327a92804fb650a94cf44d6db1a4e107cdc6d54dde08ed000b7c0ef3fe34336a48628f68f0192d7b5b8fa44f911a4