Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 20:31

General

  • Target

    059738ad0571ce207410669ee38ec200N.exe

  • Size

    54KB

  • MD5

    059738ad0571ce207410669ee38ec200

  • SHA1

    7d0a59ec089839d63d348be36df62a855ef39eb0

  • SHA256

    d881aeb137bc4a5e9afc87a34cbc2bae9d40869e914cf3babca1258625018050

  • SHA512

    b2f3c639577f5be9e6880509590a45dd8a1d9ce92ac895dc5de40b90f8e06c13f44c44fe88eb1c4d2885ce14c486767080e25fcf2a0c1f66911cce9363649900

  • SSDEEP

    1536:V7Zf/FAxTWoJJ7TTKP2awclvmxaKP2awclvmx+:fny1aP2awclvmxrP2awclvmx+

Malware Config

Signatures

  • Renames multiple (3203) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\059738ad0571ce207410669ee38ec200N.exe
    "C:\Users\Admin\AppData\Local\Temp\059738ad0571ce207410669ee38ec200N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

    Filesize

    54KB

    MD5

    01891433572e4f0793d8faa1941fdf65

    SHA1

    4c3ae0ebf562409095dc946f91483f9ff17520d3

    SHA256

    efa41d94aaa6684d9ce7b8772f7df481692bf36266be2b629170c8c5c04bb5ba

    SHA512

    b88b592350a830881c176251bba437198815b5141b5d59b1089131034338c11ea53a27398671ff831651555a7c76c46383e9629796c23bfa3364c1fcdd5c9867

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    63KB

    MD5

    70359d2f3a8a15704a07c2e84c85938a

    SHA1

    deef3be3963c9466d46086a890ecbdd693ac616b

    SHA256

    3ee8a3b3122a9e165f41de1c92c7e10c741b7717fa54629bd6e4d812eca67f3c

    SHA512

    80d99a6bf54b9ebccd5898334d57d359d98fcdcdbd401657a05a6681736f4144cc18e1a984add2270a871085f463782496ed632244607d08f1a6cd77d95d4033

  • memory/3032-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3032-648-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB