Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 21:49

General

  • Target

    60eca71aa609f05eaa5595a77d3f972877ceac6f046f64b3f600d75a1640d453.exe

  • Size

    41KB

  • MD5

    7067c6243d7ee466914bb196bc8a5824

  • SHA1

    4fb96bcfaee13f3fab4ab33d63374e05943d8abc

  • SHA256

    60eca71aa609f05eaa5595a77d3f972877ceac6f046f64b3f600d75a1640d453

  • SHA512

    df8ea199e7bfa9c00529138d40785124bab880f152e821ee0cb7bf5d1bc0ef6af658c8abee397da69318a64deae6a7f7a47f008f188ac0efcb6a866df3b2846e

  • SSDEEP

    768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lKeUeQ:W7ZhA7pApM21LOA1LOl65eUeQ

Score
9/10

Malware Config

Signatures

  • Renames multiple (3586) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\60eca71aa609f05eaa5595a77d3f972877ceac6f046f64b3f600d75a1640d453.exe
    "C:\Users\Admin\AppData\Local\Temp\60eca71aa609f05eaa5595a77d3f972877ceac6f046f64b3f600d75a1640d453.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

    Filesize

    41KB

    MD5

    1fd92684ca8b94e93324ae31c428a507

    SHA1

    e7bfba4c24bc652b08afc75e237dbbbc2a1e3e38

    SHA256

    228311452b444d696996751b3f283d8247fa20e4572081d3052ecd7bc31e0a66

    SHA512

    43f13d9a07a667875282eac9f5f5f34cc5e136bcb182290f7077feeefa27308f491b1baab1b0ff598ebbe63ce8bf62a50c430a7ec3347864e53a088d9cbc9b56

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    50KB

    MD5

    8dc8c37c54cf43b7ff1b747c4f348c11

    SHA1

    c71f755aaa47b8d4f881482447476e9d7677f3a5

    SHA256

    38e623d7a9d7b554951b004078b5476d66afd6ba34961b56bf9e971451764098

    SHA512

    0d0148909559a85ce2e6e12bfcf1f05bf1f11f39792edc2954d4592cb81bcc426d983ea4b854313114f4ad363075dcf0be8d932ad241f4893d519ca8e9dae6b3