Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    28/07/2024, 01:15

General

  • Target

    8c6ee7d113b2e782fb99317062d6f80cda3949709f5fc6a225af031a9db5eaed.exe

  • Size

    288KB

  • MD5

    d0857bb79c7f16efd639c9a16e20cdb9

  • SHA1

    53bdd7d92868e56f1b5d1d0ede8995ea8e230172

  • SHA256

    8c6ee7d113b2e782fb99317062d6f80cda3949709f5fc6a225af031a9db5eaed

  • SHA512

    8b22638a62d36539a044844b598d04e66112661982b7dba15a40aa502ccca1b96460ad229e5bf0601bb2f6728fa85c17747ee90e738129de7a5217187f9ce5cc

  • SSDEEP

    6144:KiQSoKWSYeuZGqVxBEOIAtH3D6IsZSY/6Xv5eJHwRUd6:VQtKrYeuVy+NT69SY/6XxeJHIe6

Malware Config

Signatures

  • Renames multiple (235) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c6ee7d113b2e782fb99317062d6f80cda3949709f5fc6a225af031a9db5eaed.exe
    "C:\Users\Admin\AppData\Local\Temp\8c6ee7d113b2e782fb99317062d6f80cda3949709f5fc6a225af031a9db5eaed.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

    Filesize

    288KB

    MD5

    6838ab19a695981d1ba743fc346daec8

    SHA1

    0bb11096ca52dd5db79b22e644fe74d800a783b6

    SHA256

    020b779fb943dedda8876f49061641c5207bf99f2cfbbbc6480ed15e32aef2ca

    SHA512

    395948ccadecf0787cf16371ce0f516c92e76928e1af97c3bb8caf03de39d67984fbfb59bbee99b902f960e7d6a76967a17975fdd03614e44d0eac0cb4c2efc8

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    297KB

    MD5

    104adfa6dffa5dc447a7055e879ced81

    SHA1

    1b9b42202dab40f8c0edcba5f2091fc779e07f1e

    SHA256

    da8361b63713cd44edceebca3d28151add8814c57c6b2e8fce089eb9d892ecde

    SHA512

    8bd9a6bb70116237fdf0c3dead20f5d81b938c23b51a9fff6b73482d9bf297758aa07cb474e0d15f275e84fcbb33be4a23830ee2d546787ea9a9a680c7f5b6f9

  • memory/1908-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1908-48-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB