Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03/08/2024, 01:43

General

  • Target

    b0e4d400b30591bbe189238c3a5ce8b871cb520e409f44344caf338492e45b68.exe

  • Size

    47KB

  • MD5

    f2d39ad966711d126a44b2eb1176e02a

  • SHA1

    1d3514a230447faadff388194b6c6da53d0682dd

  • SHA256

    b0e4d400b30591bbe189238c3a5ce8b871cb520e409f44344caf338492e45b68

  • SHA512

    277f7f0c90745e1c5c07f11e219c338d590785b63bcfa8bfb9d51cbae323c602ded40b5bb7341d5a88ead0b5ab0d3ad304b47a64750af0faa76d2473390f8e5e

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJXGiXZqVnHW:V7Zf/FAxTWoJJXUVnHW

Malware Config

Signatures

  • Renames multiple (3747) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0e4d400b30591bbe189238c3a5ce8b871cb520e409f44344caf338492e45b68.exe
    "C:\Users\Admin\AppData\Local\Temp\b0e4d400b30591bbe189238c3a5ce8b871cb520e409f44344caf338492e45b68.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

    Filesize

    47KB

    MD5

    6bbe115b3458b328d976fc8c50dc27d8

    SHA1

    5a93450133c7b10f60b20c28af4c406a2941cb0e

    SHA256

    ab757e186b782a1c980438c6ef7bc7c146a898c814e745eb5d420a846130e235

    SHA512

    f4203bf92b31887235334cb06a2a039bfb5f6f85d3e2e0d4ed7f1d35becfd13d503cb013f658920af30569502068c2449f89466afb18cfd9aa2b0dc0f46822a3

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    56KB

    MD5

    a0901b15e5ca9a3bf5e809306f027a6b

    SHA1

    a396368a7e72ff30764502367176d05c5838abc3

    SHA256

    0121f2240acee69fe1a1dd0b0ce1aa2fb69bc660cc4bccf59921e5f7a4240009

    SHA512

    ee4c01d081b7355f02e2927df4bb28a18f428c9445e4f8df404c9c2ec490973b9c75548a4210ae9e9f5b7f4ad4000d868e7a58cd2bec7ff45716c7273a2ed3b8

  • memory/2384-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2384-650-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB