Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 02:23

General

  • Target

    9a8c6fdf6b8fd62c279f230cf3eb7515cd052f9d7255324965191c7af1c106b8.exe

  • Size

    71KB

  • MD5

    40f60f062f5a97f05e68b612dc61bb71

  • SHA1

    bac4dbcec900a72af5888cbb0cbceb5e74f91018

  • SHA256

    9a8c6fdf6b8fd62c279f230cf3eb7515cd052f9d7255324965191c7af1c106b8

  • SHA512

    6ae78410e2219fbfa7252a14e563ee3df80f53edb0e32fe11d47abb0c8b88a66627e31937ca9d497d32d620f658e5656d1a4999dcd1abfc7b9269500386d7d00

  • SSDEEP

    768:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7u595QUhUey5vhgCy5vhgx:/7ZQpApHou595QUhUBgtgx

Score
9/10

Malware Config

Signatures

  • Renames multiple (3454) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a8c6fdf6b8fd62c279f230cf3eb7515cd052f9d7255324965191c7af1c106b8.exe
    "C:\Users\Admin\AppData\Local\Temp\9a8c6fdf6b8fd62c279f230cf3eb7515cd052f9d7255324965191c7af1c106b8.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

    Filesize

    71KB

    MD5

    c6bc42e5c3035b6eba32d621be650529

    SHA1

    aa29f84afd0c1cfde82880fce26dbf186f101096

    SHA256

    a1b63a968623d5d0cfa58250d10d7a9e1d0128a3bcd4c1a73f26c8668ccfad1e

    SHA512

    14d3a038282b8c7f0e424a9e12f5105061fe8374259607f23e10ed8b6540a89cbb0b3bf9973248e6021d978a55117cd292b60b33cd377ac513d83d9f262dc267

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    80KB

    MD5

    3716dec0261d5998ad97c9127159977f

    SHA1

    9d238b78862b5b101ccaf62eb199c89bf707cbb6

    SHA256

    8f3bd5fa8c0d6a9dc5d586d8e9f1e99b18415275975526558e3954b7d1c1509a

    SHA512

    5ab0a95f1dbcb2c9aacfb8f6ea7fb03ebbaa8f0a76d4db7cb29ff468a31769c2c08d4f5cb48788350b20faacfbae095db649895b7528dba9ff125114d4237ec7

  • memory/2484-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2484-68-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB