Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 03:19

General

  • Target

    83a0eeec22ca9bf08a6fbee7292a4a564e227be83a479269b7609d564f12e23c.exe

  • Size

    52KB

  • MD5

    bc044552f28748d6bd0051a62b1a68ce

  • SHA1

    1d42fd404e4c321f744adb068214af332ad229f8

  • SHA256

    83a0eeec22ca9bf08a6fbee7292a4a564e227be83a479269b7609d564f12e23c

  • SHA512

    189bdaa616725a3def4ec32519d5086943d85234fe2ac0346301170db454faab88de84dcc741e628e9fd00ff9fe9afb1fb4824f971f169f86039f0f9ddc5d432

  • SSDEEP

    384:GBt7Br5xjL9AgA71FbhvuNBNQFrs0AqAJwO1AqAJwOfF2JouP2JouQw5A5+w1tB:W7BlpppARFbhHFoqAJwBqAJwRJofJoTB

Score
9/10

Malware Config

Signatures

  • Renames multiple (3751) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\83a0eeec22ca9bf08a6fbee7292a4a564e227be83a479269b7609d564f12e23c.exe
    "C:\Users\Admin\AppData\Local\Temp\83a0eeec22ca9bf08a6fbee7292a4a564e227be83a479269b7609d564f12e23c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

    Filesize

    52KB

    MD5

    03fe52674d56e4c96936d4065a98559d

    SHA1

    45da8200c79c2ad5dd6a8c590981ace656789318

    SHA256

    101522964850fa94ef8db9effe1c87c978ffd103d1644addae6b91ea0afdc164

    SHA512

    5b510dca2886e739528545d57aa85a55fac9d5abf0ae0b513953bd15a2b829b1f526a17cf42f7867858b12c2ab159973129facf204c5d7ce4c0ceafccdc71215

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    61KB

    MD5

    2e197ad6396803a0943f3fcd3186bfa7

    SHA1

    89eafa924e3ab07db2eec4b1ee32a82462788044

    SHA256

    a9c8aad993d4e90e1bed359f58fe180bfbad97d60a0de5bcce29e70a4ccf2179

    SHA512

    1bd97780fd4b9194ea61a7450c270d866f4b60bb62fb4a52381db5fbec2c136bac0ac55765747cdad970038b10d55423fc65496e476abd27922be7b29bc92c0e