Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 22:20

General

  • Target

    e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe

  • Size

    72KB

  • MD5

    ba33a95231a279c05c015444b0727ca0

  • SHA1

    51258bd670b5aad477f7978cf7e527b33d48d60c

  • SHA256

    e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113

  • SHA512

    3475d30da2c1bd6b571e806e2108ddc94a7d7daac7e9e7d829beec36fc1a72e92e1570f41a77d5de6a3ab63e3faab3c6c04b0f168ce416040c96e58b499a540e

  • SSDEEP

    1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8yNCNzdwEbdwEE:62ssWpcU7lK1lKgkE

Score
9/10

Malware Config

Signatures

  • Renames multiple (3157) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
    "C:\Users\Admin\AppData\Local\Temp\e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

    Filesize

    73KB

    MD5

    f83fc727948661d72ebe6cc689c365ac

    SHA1

    80f33e132fcd7a02ee0c1207e321a74c8b9350d5

    SHA256

    b35c26b2fd6e2ef8e3508cb12e8224a1e0304c496e5cce49d983975caa67a7f6

    SHA512

    a9a2fa1cca16d4066d2051dfe7ef27b1957898aa18f3e41593465967c581556589d53a3e28c62e5ceff83fc4a32d70f1ea26827c833a4c52257ca4443d4a16dd

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    82KB

    MD5

    b10b189f62b563980ad3808ebd001e55

    SHA1

    4fc777fb873dadef3eefb6db5a5e89852bd30483

    SHA256

    0451db0cba539d07bacaf3001b79ba7916861773d715826710264c648d065fd7

    SHA512

    bce5d3222c874759df5c5d442597c40cb071bebb65c5d2b32b74b95a344703090707386fb05751105fdfd5543c97fe1d34b502b2a1d654447a98aeb776c8b9cf