Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2024, 00:33

General

  • Target

    baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe

  • Size

    91KB

  • MD5

    5671c8bbf9e774c71417d4f5ab358310

  • SHA1

    79c00fb2a4735798ba6ad68d0e7962568a580a47

  • SHA256

    baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55

  • SHA512

    5a734516e34085404bf6ada7cda5ea7e217be295879d0e2a9f643bfa4f999470ae921691c1ae3e49ef99c20ceb712be6feafdfb6aca86cb188b4700bdeedefb8

  • SSDEEP

    1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGLtErm:6e76mQSohsUsUKDtErm

Score
9/10

Malware Config

Signatures

  • Renames multiple (519) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe
    "C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

    Filesize

    91KB

    MD5

    da49dd2344a9d141f6026165805eff20

    SHA1

    d4af2eac539c504d072d75defc153dec1e57af5c

    SHA256

    36f616997cc0c7f87677884cf0ee7d6b7f162eba6e2c04a8d233acff64fe7e63

    SHA512

    43d73da09713328d6c5f10bb15e0d16784801839898cc019ba1f4bacc015cdc42c91d191179ae5478a68c7fddbb59a4b072d8a0c0a788a18c552cd908c8600dc

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    100KB

    MD5

    ba084355acac86cf2877b3ab4713a760

    SHA1

    c6d2879194db9875c13e3592fae5014b9381eea7

    SHA256

    a8562a51b76c28ebdf339e209fcf59afb308f7331425bc895a0935c69d24cd97

    SHA512

    8d6ae02482727914965ce1c9617d13118d91b56bfc7356c7d890e19c737c7222b54dfc978a4df86b9518cd27db818f7c03b37fd011c540e012acbbc4615fa431