Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    12/08/2024, 00:51

General

  • Target

    a7c04c93b4d24edab9453e1699d8b9ecc999b2761fa58494396f8dfe8bf69e6e.exe

  • Size

    70KB

  • MD5

    262a3068b9658e28d922eeb9174594bc

  • SHA1

    36a6ee3cf1d740c77fb3a0483bb1dccc895433b8

  • SHA256

    a7c04c93b4d24edab9453e1699d8b9ecc999b2761fa58494396f8dfe8bf69e6e

  • SHA512

    e03c34ca48fe679f7f6a4935ad23dc96eac1af1b8afb491f9e9ac79d6c1a467ba83123c68b057d0cb2d7a00bd7fe23f1203fc16365fca31cd7d67d25d61ddcfb

  • SSDEEP

    1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCy:enaypQSoskR

Malware Config

Signatures

  • Renames multiple (3493) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7c04c93b4d24edab9453e1699d8b9ecc999b2761fa58494396f8dfe8bf69e6e.exe
    "C:\Users\Admin\AppData\Local\Temp\a7c04c93b4d24edab9453e1699d8b9ecc999b2761fa58494396f8dfe8bf69e6e.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

    Filesize

    70KB

    MD5

    90b697f2c5e7812b712aeaf6946f8b87

    SHA1

    478c9587991143564cd18e4ad6c954223cbc85c4

    SHA256

    20a2b8b63e38ad077ece8ac91ff807633d65452a7ee1117a4c5e931434267b7f

    SHA512

    f7892da0fc9f16b326ca7bb315893cdd87294190ecec44697e8de50300a77d4d260ef57b0de39236e73744da1487330f8a03abf7a81c6cc09431c3355376d2bb

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    79KB

    MD5

    899184f6729b77ce4928ad54a849a8d4

    SHA1

    4bbe9f2464f62c35b860105b46849ccb176dc64a

    SHA256

    9c692f7519482ee411c0fd14b36bcd1e7e311ab01d21a34a4e997a7d2cc3413d

    SHA512

    8fe9bada5afb00173a4325b89e28a6399324149ecca844f51cd8db00ad72f13be08890802d1677478fc6f69554c5b73330d483846798a520f16352c11fd381bf

  • memory/2036-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2036-648-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB