Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 19:46

General

  • Target

    33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe

  • Size

    76KB

  • MD5

    75bf1ece637c4d31d4122fcdf40ff0ee

  • SHA1

    5c46fee7a2119338e94cd06b94cd3538d0eab981

  • SHA256

    33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68

  • SHA512

    d0c8948c4b24a1e9e23bbab0d896245f6ecbe7f6f0cc2aae68f6c92fd53575294c9baf96c7fd59b1378bb9d6d24ac0c4434d5be540daebeb4593c49d38a6fb48

  • SSDEEP

    1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8zxY5eYm:6e76mQSox5u

Score
9/10

Malware Config

Signatures

  • Renames multiple (3486) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
    "C:\Users\Admin\AppData\Local\Temp\33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

    Filesize

    76KB

    MD5

    dc4f59a4d0e34b48a01de5ab4402e3a5

    SHA1

    697f9a8791dab2fed5cdb5bc9eeec8d61aebba36

    SHA256

    9dcc5f6fe2a00ce23e5b08539a1e0966a0ce5a3ea5588cf24ca76a6d41a9a5eb

    SHA512

    9127a2d84e76e76cdc85a813c7835e1d4e7ec716666d8261a9e089d877d2710addb27a089e924cfee3752be4e4a8c375f7961b789d3a4fcb0979b3ad29fe0ff8

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    85KB

    MD5

    a85fca67dd31dd2262c22e6b6cb3818a

    SHA1

    1e252cfe6510b87b9b460c69cad498a1bf89916e

    SHA256

    5d084f78870c0f1914f611c76fd04a45254eec5d8d77ab6a472b7b89effea8f6

    SHA512

    b564da223912552e6ba906a44c3e9bf075a01d6b83dd1d03167bbb6adf0a0d8c37e522d337dba1589b32ef0898757de00ef7caf52f0aceecda39a785dcf4e460