Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 00:23

General

  • Target

    3a11dcab62083593c9c5ddbbf5f9aab0N.exe

  • Size

    89KB

  • MD5

    3a11dcab62083593c9c5ddbbf5f9aab0

  • SHA1

    35ae75eb56faaa3113154976c458edb9ffc03d41

  • SHA256

    d3ebd8e58a5b6eb80692a2b3d9effb38bb6a977488811ec801cd71048b1e55a1

  • SHA512

    56b6267417660ef2e907a9413e82004b25df8622295b6058aac157cdd2b3684fdc5ef8ff98803283986d3247b7458535cd521839ae66a5d7e32cb7a52e37c318

  • SSDEEP

    1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCJY5YHG6GH:enaypQSoskMY5YHG6GH

Malware Config

Signatures

  • Renames multiple (3064) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a11dcab62083593c9c5ddbbf5f9aab0N.exe
    "C:\Users\Admin\AppData\Local\Temp\3a11dcab62083593c9c5ddbbf5f9aab0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    90KB

    MD5

    58d585420397ce93520ad28d0fb16599

    SHA1

    0e975d255eb63800a334a2bd43bba1ad57389c99

    SHA256

    f632e98868b475ed720fcd21bfb4bd89ddb13bce0e13a8e296bac8646ac45345

    SHA512

    7fce77954377e3b8550f8c1ba5813d11d044269bf5f75c8996d7e0d640760bd80113061d97fd6983e7af7c6200a03d48065d250cbc4450a74d9d44ee5ab03b43

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    99KB

    MD5

    413e6e9c089cb4b9e8a5128743839e39

    SHA1

    3709539a2781a216dbbd4274981b7eddc9b93833

    SHA256

    dc295c07c016c78e04186d865cf073c1460d020d88dc5a012f36f5447cb9252c

    SHA512

    11395f28bb04fa5581ad0b2f5520f95f324312e9a00af0990dec9016ef79eae894713d50f3eeb907e02c951731c7d9d3b4757dad1d792fd605b74a72629d3cb1

  • memory/824-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/824-654-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB