Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 06:43

General

  • Target

    1799a11966c966847d595a29521c500fd42118176200b6eb8047a72b36315764N.exe

  • Size

    77KB

  • MD5

    463ec7d474d3f5017c03c54006054500

  • SHA1

    2d06471621cd7f0276588fd46a6779a531a11476

  • SHA256

    1799a11966c966847d595a29521c500fd42118176200b6eb8047a72b36315764

  • SHA512

    8f554a6a7d614a8c72c18d978f7940cde8fcf93ec1f3086f92b8984c2167113cda0d1e026b8073ed55798ddc43cba3aafda6cbc5060950554cd00cf949e90c1b

  • SSDEEP

    1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlf9xc:6e7WpRaSljZc

Score
9/10

Malware Config

Signatures

  • Renames multiple (3700) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1799a11966c966847d595a29521c500fd42118176200b6eb8047a72b36315764N.exe
    "C:\Users\Admin\AppData\Local\Temp\1799a11966c966847d595a29521c500fd42118176200b6eb8047a72b36315764N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

    Filesize

    77KB

    MD5

    81645bf47d3fea897919912dbac1cd69

    SHA1

    96e9446b40305a54f45b949103a128b6e8a0e008

    SHA256

    daf429bd7d99855ca7b843bfa1b0e7e8bd6ba44ce08f5792631dd80e294be815

    SHA512

    618cb58c9ef8e35d5916e1d08aa00f291379907957aa30e6a9aa1398d39a689d3651ce362b596e8ddae78db681e1f89996bf7c6f5ece9bd560ee479264cb9594

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    86KB

    MD5

    c69c61b7ea7a694a49e90f857fe4594a

    SHA1

    77e82d1f28703016ce9a88540775fcf4a3cb3a59

    SHA256

    ea7f3231b64cf221756b3e54d16035aeecec2d75bc75c7078687006840870845

    SHA512

    f37b279b99c3b4d7049b44bf272fbc18c169a2dfaa7ecfb391e4d282d3fdd5ea71f8cdb32fa26919751dda7106c3b3a8c335549ab20ce64c039b4fcf6d313e97