Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    22s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 18:50

General

  • Target

    0d5f2382ad71d24c8be07041345444e7859db14fde805c9fbcb26784db3bacb6.exe

  • Size

    66KB

  • MD5

    8c0ab1d2ab6cf430a2eb363e86301d53

  • SHA1

    e5231c427aa45b56307f9ba9a10c27be57bbf1b4

  • SHA256

    0d5f2382ad71d24c8be07041345444e7859db14fde805c9fbcb26784db3bacb6

  • SHA512

    eb2886a0ad02eb442db68e6f66b16174b2da9bb32d744610876a671a3293ba57e74816a72f6592a39c93362a0be3eec5839fe55a952570ec7c0491c4cad6ba1a

  • SSDEEP

    1536:V7Zf/FAxTWoJJZENTNyiTW7JJZENTNyliG:fny1tE+tEOiG

Malware Config

Signatures

  • Renames multiple (1476) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d5f2382ad71d24c8be07041345444e7859db14fde805c9fbcb26784db3bacb6.exe
    "C:\Users\Admin\AppData\Local\Temp\0d5f2382ad71d24c8be07041345444e7859db14fde805c9fbcb26784db3bacb6.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    66KB

    MD5

    48abcf8790ff357d4b612d608791ecdd

    SHA1

    7d0abee0b16ea143f3b294c8b49f55918f41884a

    SHA256

    39e2aede7bfbbfcb12e40784eac89a25717f7d30512e39a0334b8485d9cdcb38

    SHA512

    710a004a446903affe9fe9f80bdd514be1ecb2392b146ffb3a432f9582956c0c93d6fd80b13df0eac78bfe0d4d2a52b542f2ff5bd0754ed8a5999ced4c8384b3

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    75KB

    MD5

    43247cba3c8a05a31585bca6108df3a2

    SHA1

    81fc85c4b8738560ce8030a9655dc359c850b6e9

    SHA256

    69a5f040533af2fefe586e2974393da5d56e42037f303bc2e61033bf487e89fb

    SHA512

    58dfe4803cfb7d86aec90ba74a0fc1e51a716e90199ebfdb9436dd2665aa84576307545ccc806bedaca07a65d1a3b83151666bf4407ffe1068bd721071265d1b

  • memory/1400-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1400-98-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB