Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 05:17

General

  • Target

    13991151ebd79cee2af4d084fae5b0d0N.exe

  • Size

    86KB

  • MD5

    13991151ebd79cee2af4d084fae5b0d0

  • SHA1

    3ce37955084ea94d6df3624675301e3297040cb7

  • SHA256

    54f92d7c0b7a5d2ec5b3f6ad9981ab9d92cf9d4a68b6e0f65c722fe8df6edb90

  • SHA512

    6291a216753b6e9f2bc4b4b59cb2248cd959301059c77d0b582cda76c92b65dd25f4bb754d5ed10f9ac13653f04c5e51afbab9c206f96078986c4f692896525e

  • SSDEEP

    768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRe6:W7ZDpApYbWj2WTWJe+e/qXhgGJr

Score
9/10

Malware Config

Signatures

  • Renames multiple (331) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\13991151ebd79cee2af4d084fae5b0d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\13991151ebd79cee2af4d084fae5b0d0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

    Filesize

    86KB

    MD5

    80f40a1ea4c0e9fe8dbbff3bcd8c197d

    SHA1

    926c66d9778326f7d70a92a1661c1b7de08c7aeb

    SHA256

    2289ee725efbe64433f5ad4185a0678988001324be447055068c574de3a6ac4f

    SHA512

    3d7e4abbb7cc219c36995a3b359530550735e84ff86100b204098470a151e1f1b0b9664e4b61bcea2858f5133d9e87be933bf6a2ba1e5518a04d0582aee15f66

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    95KB

    MD5

    331d97eef49a1d6ec655b704a23e8d5d

    SHA1

    842d39d8539268a695e2bc71384b0827472a9284

    SHA256

    cee5b75a230998557a8cbd5138b785b658eb7c17c8966995f38f08c6140ef4ba

    SHA512

    3d99ae49bbd6c169ace5c81ff7e2c6e61dd5c51d7e90436799064fee83c12409405f0d3b73d962e45968c2be7e2b6f52a2d886aa2cd1df213cb9a5c6dd33d3ba