Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 18:43

General

  • Target

    0d50a0f0d1f58ce39376314383afd4d0ee4e8366f361ac09e3bc0836f27cc9d8.exe

  • Size

    88KB

  • MD5

    0066e6c58f3b8cd16bd04df838a099fc

  • SHA1

    7e755b88c4a5d7ed33aa7d250b42776e48cd2ea8

  • SHA256

    0d50a0f0d1f58ce39376314383afd4d0ee4e8366f361ac09e3bc0836f27cc9d8

  • SHA512

    17c389835faee45d1273d80e42444c61b5add7a2452420b858ef49066f135242f460b17f886b1ef5205bc9588452181de831708b33308771a0a2f41f52dec9d1

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZv2v+6G:fnyiQSo7Zv2vs

Malware Config

Signatures

  • Renames multiple (3316) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d50a0f0d1f58ce39376314383afd4d0ee4e8366f361ac09e3bc0836f27cc9d8.exe
    "C:\Users\Admin\AppData\Local\Temp\0d50a0f0d1f58ce39376314383afd4d0ee4e8366f361ac09e3bc0836f27cc9d8.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

    Filesize

    88KB

    MD5

    e09f2871ea30bb5223f6fd20d0bf8f1e

    SHA1

    4ab5aeb0fa6e182fff2cd1737feb4831d559c624

    SHA256

    e8f8997ef973f276048d590d3c6cfafb8603da62fe5ffefb627028be9b399a98

    SHA512

    b668dbd8d31c194a97d7bb837513352d4afe5334c64a7d39472d68e581a7881cb2596c55b815a253a0baf8ebd8cae55067edaea6448b39a2702eb7c0b0cd84f5

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    97KB

    MD5

    51f0daf581cdbd4372d6975db6792fcb

    SHA1

    b9c1f7b619b0db63e05db9367f6610e1ed86c1e5

    SHA256

    1d823d162061d360e6f69d80280bb5b610b81c2706da5f98252441ffc9886687

    SHA512

    50dba51d9c2bfbb29cb0d63a03f22a03965c44459255cc8249e27a09f6ca8573cca81a3c65fd6ec16066bd003ee35accf0c30d648884925d51a275d4b98bb13c

  • memory/2360-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2360-176-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB