Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    06/08/2024, 05:18

General

  • Target

    630805d8200009bd71094b89a26c82f0N.exe

  • Size

    83KB

  • MD5

    630805d8200009bd71094b89a26c82f0

  • SHA1

    7075d78ea285cf2e80ebafae65784977b2b2ee1c

  • SHA256

    233fe7bc23d5a67d58fb4235fbeac235e0d0247f865d94f49556615549c76d81

  • SHA512

    826e00622c3e0c4605639f6b92b42eb9d1249f471e24c4e3d1703ce02d65678ff31a403d35892eef2f818a0e7e30892594840b98a3f9c41634438c08c071ac3d

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxyhy:fnyiQSoS

Malware Config

Signatures

  • Renames multiple (3177) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\630805d8200009bd71094b89a26c82f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\630805d8200009bd71094b89a26c82f0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    83KB

    MD5

    65a33fb5c6f70d50a2a7af2cf2b3d9b7

    SHA1

    7059ec495b2334d46886aecface5d8635ecb797f

    SHA256

    899539af777fe3cfb3740b3ac633e897bb2742a6e3b392f0e20b838989dac11c

    SHA512

    0a4d618f2c8d5182842c17ad866896e15d67dda55fbbdf156afc975adab666307bba621c892121a529997c11f5c15ac8cdf6102e3579a0ddffc1b01dea2eb64d

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    92KB

    MD5

    93145e4b597cefd4dd8b211be9119fa1

    SHA1

    a98161c3c790fa393d6e9d7feab1c1f3a649e34e

    SHA256

    21766c8fac665121d589380c2c7a0ed64d548f74191202672b6d5f11f0ec6b4d

    SHA512

    d831b27de2853aef17d590657ff2e488aed3946bc8dca61a5ae1c6ba2f7469cb47b6e7a2a38b4703a0fcf4c478dd13cdbc51c02be61d7badf36e9339ee8ee502

  • memory/2316-3-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB