Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 01:16

General

  • Target

    9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe

  • Size

    109KB

  • MD5

    1b90e32357e4ee996f7bfe5738c2de30

  • SHA1

    a261b2c52b036609eccae9940532889bccb3edbd

  • SHA256

    9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bb

  • SHA512

    957e8c2d34241859c3dbf8db4ebc04ec18f4ea49ee9eb3af1ed868edea63d63f47847afcfc6a583583c99569ecb401231802458a977e0339c6bad327b008a7d9

  • SSDEEP

    1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPIUpCUpiPZ:6DWpwE7oL2e+efZwZ08i8Q

Score
9/10

Malware Config

Signatures

  • Renames multiple (2911) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe
    "C:\Users\Admin\AppData\Local\Temp\9cb1e0d5ef7052c982e6ed4c09d9666b890e7c1b1bdc1ebf9c3775e4b4abb8bbN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    109KB

    MD5

    14f6dbae1ff48c630285b939604f2d3a

    SHA1

    d24e055f38abcbb0ebade3cfcd97df21ebcbf62e

    SHA256

    8c386dcd66541089539de7fee75218f81fda4f0544ec8f617c49bb1b3bb65d53

    SHA512

    5d971333328b25b21f16be9e5625d6116b547392206a397983126ccf69346e5c08447e087587754ced3267ef5889fa0726e8631f53736771a0ae74f67600844d

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    118KB

    MD5

    e0d6e79ebd6793b50e93e7549c45a06d

    SHA1

    30fd53dd439bd60629666f1466ea72ccc2182a2e

    SHA256

    7064c4685a1d4d9b47f7e2649fbd7334ce5eba15d2bf6921e559177dc3d9c7e4

    SHA512

    45ba82f20fbae5a2da9511c977c35a3e470dc0829351b93c84388ee314668b032214a92d15d4684facae9517a116904fe297df52fb69f59d99414f85e58f18ce