Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05/08/2024, 09:49

General

  • Target

    78e958c9f6addd0589bb5175aa3cdf10N.exe

  • Size

    147KB

  • MD5

    78e958c9f6addd0589bb5175aa3cdf10

  • SHA1

    4b446c0ffe961c406a9f9add30dd66f63335a2e2

  • SHA256

    1aba43ffbffe2aaa82a4ac7ba964b797731530c767b52d35185c356436432e66

  • SHA512

    fc4b06c9dc6b0debf4d9fa196c0c5ad40b0c86e72a68dd021ea0f31aeedcf43f486f1a2a2eada4297765bec54ca4a2aa198ff71bd6505beaa3ad2a0fd2109dd0

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZf2XcqvWTWn1++PJHJXA/OsIZfzc3/0:fnyiQSo7Zf2XGQSo7Zf2XS

Malware Config

Signatures

  • Renames multiple (2851) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\78e958c9f6addd0589bb5175aa3cdf10N.exe
    "C:\Users\Admin\AppData\Local\Temp\78e958c9f6addd0589bb5175aa3cdf10N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

    Filesize

    147KB

    MD5

    cbd6d97dd6a6081635c0b2203681a5b9

    SHA1

    ab460bbe891babaf1607cc06c436751b41e0ea8d

    SHA256

    e5f6cfe6f23e747bb72647d0f6483cb191334602dcedbe051929601fcb8d49fc

    SHA512

    eac3c361da40f27c8db3e7793b292cde5fe56dd66da72d2c0c325a4bf3f37211c2d798b076f62e6baed3c643770dae695fda2874e2430382928482398e7d5bdf

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    156KB

    MD5

    0bc1a427736e8f16f4848c8ab525192f

    SHA1

    3d5ceb50cd4273d31e95166cce7e14b198877cf2

    SHA256

    71b9afe67174f49b5fbbdff5c506233700a8b6c0f043511d71f169d069eefcd7

    SHA512

    1c3360305624e11231f6e4a7a32e11a82869e02fff2e3feb5ce161b47fa1eb80a5399c99f5f7af72e5028b50fd22195e3854752890823eef30c70a8b0cb41020

  • memory/2700-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2700-644-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB