Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 20:39

General

  • Target

    41aff372a27df7741d76bcfe0be410a296a4aed2e855296a5bf4d07751f47bbc.exe

  • Size

    88KB

  • MD5

    7b15b47645283912b8400e1bc8a67d07

  • SHA1

    d9f4ef6ae1feb9188781751e7f64f9827d112ac9

  • SHA256

    41aff372a27df7741d76bcfe0be410a296a4aed2e855296a5bf4d07751f47bbc

  • SHA512

    7e76d86742838c863dd9131aee9b0c38a1f7fcc6e8ec007061c0126e6ce6701c447cff3a60316da547b2725aa957913a6dd8bb93dcbdaf3dbe7edab2f094b96e

  • SSDEEP

    1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhS:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs/

Score
9/10

Malware Config

Signatures

  • Renames multiple (3682) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\41aff372a27df7741d76bcfe0be410a296a4aed2e855296a5bf4d07751f47bbc.exe
    "C:\Users\Admin\AppData\Local\Temp\41aff372a27df7741d76bcfe0be410a296a4aed2e855296a5bf4d07751f47bbc.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

    Filesize

    89KB

    MD5

    2a8bb150ea5136c81ffd30cf92ce17e9

    SHA1

    9b43d71f43c5f0b4916d2fdb02dddf240209bfcf

    SHA256

    145cdddd52761e34f8f2817f45f3d89ec6eabb095d73b788f02bde38266af296

    SHA512

    35816877c0a810120f4bd3e5bfaebd621aba773ff3f99fc5b8fbb8262d9e2be7388ad336cd746587fa67f740178d9e9aca43fcdad87be5df1759b4145ea4b98b

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    97KB

    MD5

    c173878ad49c07f206f8fb50f9e602a7

    SHA1

    3ea512860e73419c8180708209ffe70dcad16366

    SHA256

    abdc4447e4f5eea2f4f7a0f52a91c5309f7d29e75af72a23f688f986a23d337c

    SHA512

    62b53302d5d5bc8b5ec9c468581ed643cd5fbf66c3b52b04b34850f4c28ce2a4f51d12c3822ca08a9d2265c1fd587edde189ddfcceb6c5fe9a54f8967a45f3c7