Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 13:59

General

  • Target

    f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe

  • Size

    42KB

  • MD5

    dafbae086e37b421c3b02e274fbba830

  • SHA1

    5317b03bb4165a4f0373550ee508ee8b8246d4e4

  • SHA256

    f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fd

  • SHA512

    6d4b67861071aee92ea08b7642aeaa21d31a3af51536175e4c58461cf293fe334c6ff9a9c05dd731520af4d3aaf0912d6e85a4b4027a736ee6603c3a989008df

  • SSDEEP

    384:GBt7Br5xjL9AgA71FbhvuNBN2TQ1nrSLmnw1i/JN68gK1i/JN68ge:W7BlpppARFbhknrSLmwslsX

Score
9/10

Malware Config

Signatures

  • Renames multiple (3430) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe
    "C:\Users\Admin\AppData\Local\Temp\f7953bd202694321b393583c936d4d63f5d07993dc0847541fb346ba5beae9fdN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

    Filesize

    42KB

    MD5

    2c45a35d6e268b4f9aa49cb71beea8bf

    SHA1

    8b5cd6717e42f7ba334fa7cb1ca6f4748bc8d334

    SHA256

    bece5ec1901eb2ce0060d01d75074b247493ef0744f0263824add73f20828370

    SHA512

    053d13571de89076bc095c751bfce9e45e98d28864f7d605ca66a903922397353b705b1ff2506aa4946d634a6d62761d98d760fa77b4d40f0241c814044d011c

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    51KB

    MD5

    a6c6edb9eb89bb1d3f7dbd9ff2adb44e

    SHA1

    61c13f222c261c17fea0edba6895d287bcde8014

    SHA256

    dd42f840d3cfde8d42fe6fecb4c7c2ea6f1225f7ba438531cec3eb7d1ddf7de4

    SHA512

    8638aa42348b514754a34c5109058751ea4b8ed7f41b9905c22243df136f0ef3d73e96071e7ec18be4eabe82c1e301e3ffe38b76f2aa08e9a97434c23632bb91