Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 19:37

General

  • Target

    23f9abbacabdcee72da34e28f0d93504f7ece62eb9a0fb87a7c914f5495498ae.exe

  • Size

    69KB

  • MD5

    834e54d7404b85938a80bbc52bb202d1

  • SHA1

    c362ef7a4aa83cdf96a7a849cf706a7c73073b7c

  • SHA256

    23f9abbacabdcee72da34e28f0d93504f7ece62eb9a0fb87a7c914f5495498ae

  • SHA512

    30ee9737497f0d2ac13ee254ce1403902fabe46a9898a25705fa4f8481ac5835d837960d5c638e66fb5cea0c799bf6c7926f4514c668ca3c67e195902599d696

  • SSDEEP

    1536:V7Zf/FAxTWoJJB7LD2I2InTW7JJB7LD2I2IF:fny1tD33wtD33F

Malware Config

Signatures

  • Renames multiple (600) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\23f9abbacabdcee72da34e28f0d93504f7ece62eb9a0fb87a7c914f5495498ae.exe
    "C:\Users\Admin\AppData\Local\Temp\23f9abbacabdcee72da34e28f0d93504f7ece62eb9a0fb87a7c914f5495498ae.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1140

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

    Filesize

    70KB

    MD5

    f41a7815edca971deff930d60af9f4d6

    SHA1

    bda64bbdd80d34a24e864492718348fd823403fb

    SHA256

    01e02f3e79ec0344ebba0bf1c0d2abeecbf73aa7ad59050631c61a9cbc6836af

    SHA512

    fccc588b94911139eccbf27078634f41c4239366232fb62d419f0a5169918352008d117a08c6623b539986c0f594f874c8b6efc2a76562ac8ad0bb0cc113545a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    79KB

    MD5

    6fe9d0bf51d3f1488dfff199ba7058ec

    SHA1

    03a38be87bd29fb037a9af16fad2bac336546b7a

    SHA256

    cf74991a6c1414bad9e9f8b6596dfb4f3d2018ab3f188d844a4d992c7213a345

    SHA512

    77dde2b664bf1ef311655bd4e3ec26a0e7aad01095932290bbc24482e0bb41e0cc853abb49439efc2cbf3462a383f44889f2b36432a9bd114eae7f63d00966fa

  • memory/1140-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1140-68-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB