Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 04:24

General

  • Target

    6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe

  • Size

    82KB

  • MD5

    850663fdc1731e7c026c98b20f36e480

  • SHA1

    bd1702bdc2861f268e71048d6782912da883f894

  • SHA256

    6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075c

  • SHA512

    22a3d4bc4901bc236f2ea36ef3e73781e85c14561b9b5dda858dc1d003c48c69dbb7eb4dd4b8041ec7cf81f6952750b80ccc9f292c0312de05653780ee7c905d

  • SSDEEP

    1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGlMr:6e76mQSohsUsUKa

Score
9/10

Malware Config

Signatures

  • Renames multiple (3548) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe
    "C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

    Filesize

    83KB

    MD5

    986058f496af83ed08e5869842dd57de

    SHA1

    25b3d2f4a0e5f424fb30308b4da2aefdb81ac017

    SHA256

    4adf88581e7abde6f606d3fc3595fef9e513c44722a3ee6ba194f933fbc888d8

    SHA512

    588886e7bda34fd00852bbdcd6d7e37f7a33e0163c55c07885a848f4e74c200d233e01246da356799579724a9a5a1f547cd3da89564a3c38722dcd0bbdfa6acf

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    91KB

    MD5

    60c4f15d281b2dc90f38767940666fbd

    SHA1

    7da19666189f3e83ef19912a455fa9838dbb6269

    SHA256

    53ee57016291693b8cf7cda7cc0ad51d73b8e7a51f6d34d87b19cf1cdba999b7

    SHA512

    585fed080a3a5b13b91fe27ecc14a6d2c15c1e49ea2d897172c72e4bf791326fec60124f538b931d4fe61d92544f3683ba6750a38a3d2c5d1890bd2c558ea3fc