Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 18:21

General

  • Target

    3e1d94878f4a459a8d537d922a0c42a0N.exe

  • Size

    50KB

  • MD5

    3e1d94878f4a459a8d537d922a0c42a0

  • SHA1

    ccb905c9d5a6acab7ab7f9b37299b60282913a3b

  • SHA256

    7bd0c39e8d19fa5fdf75707e61b7d1ea0d189648fff66e1888507cf0c361e28e

  • SHA512

    3b982f7ef0cd1e6d72f7d3683f41ce6b26b9e2c680ad896f82263595ab0830bfa9250591cdaa0c8c9a9057e0540a848b94540dcad00e3b54a887ed677a13a0f6

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyIHAJvHAJLMF7:V7Zf/FAxTWoJJZENTNy37

Malware Config

Signatures

  • Renames multiple (2445) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e1d94878f4a459a8d537d922a0c42a0N.exe
    "C:\Users\Admin\AppData\Local\Temp\3e1d94878f4a459a8d537d922a0c42a0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

    Filesize

    50KB

    MD5

    bd90db7a247e7781113b4cb56c072d7e

    SHA1

    85458504e01269521a0fbd40636175998fad021a

    SHA256

    f15ef73a0a83db266d86e2fec26567cdb651ef6bbfdcf42d4fa121e41bb2fad1

    SHA512

    17be39a2c0abf479e60a61598f98a20097d6e44c1d9d4e6075662c3b6ca407665ff90758871e399982876b8c96c67c9b33be17764019e1c30723d5fdd0bd9bb1

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    59KB

    MD5

    8d60eef40a07b7a1d4e3b3e26fdb45d5

    SHA1

    ef124ddcd1da6f294a3b74a80e8a7ed69207b091

    SHA256

    1be93e6d64f44ca51973b91c17298f07482e0b53217a8fff01faa2909dff47fb

    SHA512

    aff9d82a24a501885098aaa47f1cc8fadc6a6a75e74e03567d9e4984eb4369e1f20dcf43fee49c0404ee4bb3d6ada05ac0fcb34c47bc41577337c9d4ff6515fd

  • memory/2480-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2480-162-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB