Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 10:58

General

  • Target

    714934b61772a392fc16b0ebb52d675b1a810f662dafef4ba21dbc9e8ec690edN.exe

  • Size

    41KB

  • MD5

    49c975e5c4ba16dfac6d45330a2b3020

  • SHA1

    44eb207513761b42329bb95a82ff8c2202a2e9e9

  • SHA256

    714934b61772a392fc16b0ebb52d675b1a810f662dafef4ba21dbc9e8ec690ed

  • SHA512

    1a3b56290357c4e788e290906093de5de154aac953d08cf61a16023f362d2f2d947818fc5625f14b97134ef264b8686b63fe3b206e0eb14b388f02230dc9fd5e

  • SSDEEP

    768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltj8Tu8Tf:W7ZhA7pApM21LOA1LOl6Aj8Tu8Tf

Score
9/10

Malware Config

Signatures

  • Renames multiple (3252) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\714934b61772a392fc16b0ebb52d675b1a810f662dafef4ba21dbc9e8ec690edN.exe
    "C:\Users\Admin\AppData\Local\Temp\714934b61772a392fc16b0ebb52d675b1a810f662dafef4ba21dbc9e8ec690edN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

    Filesize

    41KB

    MD5

    981a6a3c686072421da6a2bf53854b3f

    SHA1

    944d176cc54c24d04483bc3dd87ab857f3fc8c62

    SHA256

    e6cd463300317d454602e08d238fd69b1b2a88568a76f1622cc7a9c6c9834300

    SHA512

    b1060170e3817ac623039810149813f414e95c31a81648e685955b4b975544d2ac71f1fbb949a911cb7e76020e8722b26022741a5ba6299b5be4a9ea4e736274

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    50KB

    MD5

    3b7a6ec145b6146d7940e2e31284b331

    SHA1

    0353dc2f2ddfdc6fe5ce236b05d26bb0a4ac13e8

    SHA256

    9be81a949901a230ff490146340f7b0372065c074cb6d1cd841e27d527bd7dc2

    SHA512

    d3e2442ac4fed114e8c6e91d67e80028ff69fc9ba668d4f480e44ad70cbaa9be64fa72b2fe7491fbc345dd7ed6e99103d929b0d5bf07af541505861e5d159b6c