Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 00:24

General

  • Target

    9b8260959a9b5ba39a831174b24098c4ecca8b017987ff527660f032bac17d44.exe

  • Size

    50KB

  • MD5

    d13dcfa3acfa13b2e066a5bb973b4b3b

  • SHA1

    5358883a387a140ead0702a09c395cfb90562b46

  • SHA256

    9b8260959a9b5ba39a831174b24098c4ecca8b017987ff527660f032bac17d44

  • SHA512

    fd873714eb0f55b79b535710bc21466364a0823d9c202ebab576b40d41753fc404c6cddcaebd3981b79b68e76fde26d533084747d33d9362e7a1ba3d4931aaf8

  • SSDEEP

    768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFew/DbAGw/DbAu:W7ZppApBULcfpHLcfpyDoAu

Score
9/10

Malware Config

Signatures

  • Renames multiple (3725) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b8260959a9b5ba39a831174b24098c4ecca8b017987ff527660f032bac17d44.exe
    "C:\Users\Admin\AppData\Local\Temp\9b8260959a9b5ba39a831174b24098c4ecca8b017987ff527660f032bac17d44.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

    Filesize

    50KB

    MD5

    72da726c456be0018bbb91b632bf3283

    SHA1

    e8e4d45e2b0e6c39cd846192e919d910bea09219

    SHA256

    6b3549b2cbeb35fa00c5b0da28e381886340a07dbd91213179a890cd173ddb40

    SHA512

    9f86115e10c327abe9f79cb7e68fa446c63624081e7ae7deb50ad72291b9ecd4f8c944f16541bec8988abbcb5f4d90ce2f5fd93b50c265d6abbac2832eb8e8d1

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    59KB

    MD5

    015ce24ae7c9cdfa3aacc346a8778d7a

    SHA1

    5be7858f91e4ba704ee52fcff511bb3eab56c559

    SHA256

    72b09845add86db93fbdd891110259f315ccc067c67dbf21cf8964d7ef67c20d

    SHA512

    9bb610f8269af7bdd6d74d89d168a2184d484c19a63b8fd6c0da17fa310ec158f5bfff260a182f0584e05234e8b7fbcc484c83771c99a08e2b77540a8fc42256