Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/09/2024, 23:48

General

  • Target

    91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe

  • Size

    50KB

  • MD5

    2aeca2bcd7d4f8f548164fc6fd1008fc

  • SHA1

    d1a2e30526930340a6ed227b41aae8cbf0fb6b48

  • SHA256

    91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820

  • SHA512

    bcd516c32468f715bbd81c27d76b6216c812cd1a4138d714c01a92d9ddb36f63bf690120462f74413a1a18b0cd5a38e71d2e24031ffa92003cc2e8016ffb71ff

  • SSDEEP

    1536:W7ZppApBULcfpHLcfpyDUdyGdyjnKwjzhjzr:6pWpBwchcwDNZjVj3

Score
9/10

Malware Config

Signatures

  • Renames multiple (3660) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
    "C:\Users\Admin\AppData\Local\Temp\91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    50KB

    MD5

    65c57d3889c0c2ac608fd2b31690935a

    SHA1

    530a59bb3c79a2b732c49f49e37cfc943943947c

    SHA256

    858f461f5712863374f3efc1f23e0ce8a1b54a3019248bb976f41fe976df41ff

    SHA512

    6553175e98921bebfe5180a522cae3449dd3df26f8121f62c26cbe2e2302f0d8c2760ddb18a1da1b9ac2f9ed45ec0c8718a4563e6e5bbce2466a4dae54fc2b08

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    59KB

    MD5

    9cec0f09292cf381d5c5b553413029d3

    SHA1

    72718568e06cefec8177036bbe62cf8d4b4792c3

    SHA256

    d259a60e85a8f867b5d1defc582f9ecd88122b9d206530de140e0b0e7f39c7c6

    SHA512

    0ad8f2b0b931c90dd5df4cf43bf99de74a3f37ce9d77d2282c0a8ea446a25724b021531f16c094d7490850b55a4cb77eba6e541c748ecfa5071a2027e26720c0