Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 02:27

General

  • Target

    cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe

  • Size

    87KB

  • MD5

    09e7528d6f8898efd2db84fb8ea215a0

  • SHA1

    cdda47e813f5ffe3e23321717b6b0fa6fbed9efa

  • SHA256

    cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809dd

  • SHA512

    055ed367c6567500054f2dd6997314f08de554e892b734b9369fa0f4da6f7d05eced15a89bd1507da8ae1196ffab0f1d8aa4250b0048d30aa32adbe1b06c89a0

  • SSDEEP

    768:W7BlphA7pARFbhM0KW2s9B4b09Xgd7jylZqzpEPZD:W7ZhA7pApMaxB4b0CY

Score
9/10

Malware Config

Signatures

  • Renames multiple (3089) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe
    "C:\Users\Admin\AppData\Local\Temp\cd602a586edcab7e9669f908665f3e599dc41b5ed4845fabe4a3ae8b0a8809ddN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    88KB

    MD5

    9329dc58035758f73ad886279c5618e3

    SHA1

    29f1ba127e34ea3a5bbc561323cfe43c8dec0ee6

    SHA256

    283baeb3348e5e0fb5365c930db468fdd001110f606f20f8df5c217028cccb80

    SHA512

    3f71709dde0f1b2c195f0f924189187e84f0e22a07fd33d094a06ddff6695a7377d111492e21a5e29cf5e0833bae0b0c02b8c0f0a8f2a0253771e8b45462d5db

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    97KB

    MD5

    52d8ad00c93044b08eec18d945e1cb79

    SHA1

    b32005e583b376f1812a6ed4f16cc4734a75c86f

    SHA256

    09b5ffc863f2b4b3d125e9565dd11ec74b8c0f6e7c7e3040dfe1ce3e0b5daa31

    SHA512

    223b3f00219521a12bc408301005bf2676488ed1f8c520c1182fafa90f7614de1f4e5d4f6d2ec7d1ee48c55d40c9844f4db0cc70255532634d5177824d0702ca