Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2024, 00:30

General

  • Target

    baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe

  • Size

    91KB

  • MD5

    5671c8bbf9e774c71417d4f5ab358310

  • SHA1

    79c00fb2a4735798ba6ad68d0e7962568a580a47

  • SHA256

    baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55

  • SHA512

    5a734516e34085404bf6ada7cda5ea7e217be295879d0e2a9f643bfa4f999470ae921691c1ae3e49ef99c20ceb712be6feafdfb6aca86cb188b4700bdeedefb8

  • SSDEEP

    1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGLtErm:6e76mQSohsUsUKDtErm

Score
9/10

Malware Config

Signatures

  • Renames multiple (2789) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe
    "C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

    Filesize

    91KB

    MD5

    4e64e039c92286ea5b570083d2f2741d

    SHA1

    41135158d3aa8c08536447b8de5a2d9f3f103053

    SHA256

    bc707ab44c59e6879ab8967a35de432798b4a4cbed19e4d7cc2638bb287d71d7

    SHA512

    fe634d4773d66c5bf8a6c9753abdbc213e7458c989b7c65c7d79f27768489ee8d21e97c06933d30c3163d3eff74f3bc4d4020ca299b7acdf497f2dd428220bc6

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    100KB

    MD5

    27be7056c188978759e406a8dc83b8ee

    SHA1

    f98d1d2225b84995d3aee039ee3c31add969b57a

    SHA256

    e8ec767eef13d64e2c8be3fc5d580623954635c5f337a2f4a1f6a4a45173e162

    SHA512

    04ac391fc14aa06fd85161263c6821c7f9aabcae963c232fc3b86c8152e4a24c3997d2924ac89e43004e1f093ab435e905ce73db07a7214d445b663fba61e24b