Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03/08/2024, 02:30

General

  • Target

    beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe

  • Size

    57KB

  • MD5

    9e489e78a1f1616b6d60dfa94ff00ee8

  • SHA1

    3966f5764b212c0f36a64a1ff95cdd324abdcda9

  • SHA256

    beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c

  • SHA512

    7b632a8d396dccecf442347e82a38df8360f3fe9c2c07b78f41de2144fff6cb4782ad50afdfee550818a11cddc13b5e920d37f11a200816bde8ba1b611e7a02d

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rA:V7Zf/FAxTWtnc

Malware Config

Signatures

  • Renames multiple (3742) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe
    "C:\Users\Admin\AppData\Local\Temp\beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

    Filesize

    58KB

    MD5

    e9426045bb1ec094c1b1c8b4330e4517

    SHA1

    a3b02fc3cb949a613df8b05dec401c1907334edd

    SHA256

    915c1bf46274c926da26d42fa6811a99c0765317c0e492ad57a77d33d0238a28

    SHA512

    8afb6b29084f3158c54b8f6f6b7dbe82c7cf50f68876cfcb6705729d67c293204cf0b8ddba547155a62305b516a44f2f9f669b32bf9c4f849987fbc0b3ca4dc7

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    67KB

    MD5

    fb73d37ce7919efa5723a8ddba0d9a97

    SHA1

    75d6f8a7041021b10fc86460e9c848e29a5de133

    SHA256

    8a56a20307b72a4d7ae1a65bf18783e2592ba8eb7cb9c5ecb684f084872c7738

    SHA512

    c077d1638ddf6a97ea8a4ad655de8317c55e59c6217bf6f66ffeffc99401834cfd8337831f6a9bcec91323e5f3918deb0a0ed0f40ac5dabe5df9672defb26379

  • memory/2316-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2316-648-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB