Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 20:32

General

  • Target

    e3410d39570191606215cefcf9837000N.exe

  • Size

    40KB

  • MD5

    e3410d39570191606215cefcf9837000

  • SHA1

    3e17e6070fded7b0315ca004fd2914d0c097949c

  • SHA256

    45f47a3b60ab87be44aa846276888222857c349e7e7326a5e14f9d8057ee1c3f

  • SHA512

    73f4749b1a785b90c603200fe1caa3261453854e334d6ce1bb39e5bb2f54e58d57447bad16038ed0cbc92f1834d01a477e2d6ef9e05861b83c1f843fa74d5727

  • SSDEEP

    768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8tiOeiOF:W7ZhA7pApM21LOA1LOiiOeiOF

Score
9/10

Malware Config

Signatures

  • Renames multiple (331) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3410d39570191606215cefcf9837000N.exe
    "C:\Users\Admin\AppData\Local\Temp\e3410d39570191606215cefcf9837000N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2096

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

    Filesize

    40KB

    MD5

    a83f085c5cf7331aca59bea5fbace635

    SHA1

    ae2eed07145d74fc097cb289c940be391527cd91

    SHA256

    0ddf8d24a2cd703e1892db06da449325feae1b5599aa9de8961baf37141213e8

    SHA512

    f130726159d847b486272f82931075abbb9ecdc98edf84a869ef3b16f9f2d30e529f5ef4b6138807e68fe1903a8b1473f4b3a6fad249a059ec742cb6655e35e5

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    49KB

    MD5

    07c5d31b4618e41d63c86a6fec582ad9

    SHA1

    6826470e053a8102496556d9b5f4bb6163335d40

    SHA256

    21dcc0d1b5d5fcec3d741c67b71f20ab38c4978c03ca03c0b0a486289bdc2916

    SHA512

    42109b310dd7468e063d7424194105a053db4d64d0cbc1fc89526a34234115025a2e53c85a70e2d88cf3955ea63a4729437ec32fd7cddf6c901bc02d0f78cea0