Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    15s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 21:28

General

  • Target

    341962d19972c5a639b315c9ee796cd0N.exe

  • Size

    45KB

  • MD5

    341962d19972c5a639b315c9ee796cd0

  • SHA1

    c2d3ecfcb041425822209ec75e21491c2556c977

  • SHA256

    d31bf76aaaeeca973ff1e4a3648eefd638977bd5409f47ac576be4ed65a48d89

  • SHA512

    82f3442307c57f0f04bb2fd5136d23ce93dd2138f840e0ff4ecca2d4664474377c1ae1a255c32c960144375ff0239bc5ceef93a495cdff3aae5a16f6811f4f22

  • SSDEEP

    768:W7BlphA7pARFbhM0Kkq81LOyq81LOd+KF/MF/i:W7ZhA7pApM21LOA1LOX2q

Score
9/10

Malware Config

Signatures

  • Renames multiple (340) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\341962d19972c5a639b315c9ee796cd0N.exe
    "C:\Users\Admin\AppData\Local\Temp\341962d19972c5a639b315c9ee796cd0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    5a8f629c12f8168540459f45e7e3fee3

    SHA1

    82c43ab5bd79ddc2249258f4f2ea28a297144c03

    SHA256

    211f02ff9dbb1b15de187d98d3d8b70af3daf88e1794b8e860d8a1f0883ef48a

    SHA512

    92d57f1d0447097a45429a75694737abd8a3aa1993e8551549c792a9f39d2f6f6d4e952e7bc9e9971ee02e3c0ebf97e0f7259cadaab55108dd90b26b594b020d

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    54KB

    MD5

    1ef58b13b32fc4d46766a3a4f0723ff4

    SHA1

    6ba716af7b7a6125b6906d3c7d2975571a07b0d8

    SHA256

    c1e0ab8a72a830f4860f1a4c336cffaf9f0e9cb92321d913997fa26ffa3cba53

    SHA512

    5596d971fd638c5434bd3fd7f36b72346f73735251889964ff30c19948947fc6665fc23586425c083f7001221c09435f9f6d30975c0b887a987868296ba26b02