Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 12:33

General

  • Target

    0b17386631e0ceaff83d8019558bf980N.exe

  • Size

    78KB

  • MD5

    0b17386631e0ceaff83d8019558bf980

  • SHA1

    f14aff16130c383fc8dc102055c115c6c1c3c0fe

  • SHA256

    4278cdc700ab187a22cf63217d6d15a70fd589537927fe4ce1e9859413c99d3e

  • SHA512

    52baf2b1762c201a82644cebb444e249dfcfe0a9c82b89ceade9df4966ba1308d96c48fdcea8e9f621d7e2091770f9d8d61e2c0077bec9cef0ea32aecfe4ea73

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsK8/8A:fnyiQSohsUsxkA

Malware Config

Signatures

  • Renames multiple (224) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b17386631e0ceaff83d8019558bf980N.exe
    "C:\Users\Admin\AppData\Local\Temp\0b17386631e0ceaff83d8019558bf980N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

    Filesize

    78KB

    MD5

    75227912fc6a35da7ee9bde9aec2a60f

    SHA1

    785db58df523d8dc454d5e4827766c924b6bcd83

    SHA256

    9dc264eb32969d1c7f45609106fd4fefa08ad2fe9c9b71bdfabd73cbc4d5c52d

    SHA512

    ed6607e37e283989edc1a9465d8c770e35880fec5ec12c0de3b389c4e0c8b100f62dec2ea05e7eb1b8df14797c76d26b55e3fc15580aba84baf3cc95da18dc23

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    87KB

    MD5

    c9e488b97b829e81a15c5e1a4089f80b

    SHA1

    9b908f2c8fec95a8321c10f993c2e56bd0c7844c

    SHA256

    a657b9c6cee9688cbbe72ce375272ead00b4682f1921edb3ceda7d9db53e2c6e

    SHA512

    1b02fc897a411208391fba9769c52ec208d3b9aa10b3cdf58cd6ffbe890118cba6e7360afb5419f8d8a96630e383deb15dec78b60276618df35d8b9168189f93

  • memory/2292-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2292-50-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB