Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 18:42

General

  • Target

    0cdee55b1412f41442a307c397ec22aae0118979819b37855b1d68f3d6a987ac.exe

  • Size

    28KB

  • MD5

    937d7cf40d42230e78c07baf8a84b0ee

  • SHA1

    3d72f9b3f0582f744d6fb74aff28aa0bf1b97a33

  • SHA256

    0cdee55b1412f41442a307c397ec22aae0118979819b37855b1d68f3d6a987ac

  • SHA512

    f1b37d6b197aa33c9ffc8fce4a98d6dcdd1b782e92840d97bbe5fdb399befba618511e36f426fb58ccb6aca5cdd04ceacf6ea73e804119c4c05f5e8c0d868fb4

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9NNgNR:CTW7JJ7TzNgNR

Malware Config

Signatures

  • Renames multiple (3756) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cdee55b1412f41442a307c397ec22aae0118979819b37855b1d68f3d6a987ac.exe
    "C:\Users\Admin\AppData\Local\Temp\0cdee55b1412f41442a307c397ec22aae0118979819b37855b1d68f3d6a987ac.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

    Filesize

    29KB

    MD5

    87a4673c8390135bedc723a36b218311

    SHA1

    4ac92327d5d4ae38fd56d08b8c7a6fc4070b9127

    SHA256

    cc598256f82d87eb5bacd4fd4e637addc7a422ae9372ced2b98a9af663ad454a

    SHA512

    42a12a30acb003b0b0dc2aaab0bc0018c4b33551a1f106771e9b2d5c25bf9fa6caf3daf406e076e8f12bdd304639fb76ca8884cbff88cfab8af762ffcd23969c

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    38KB

    MD5

    b0fc8b9b2f21b04e476465ea7b15b51c

    SHA1

    aeb77955ac3d19146ae85da9c0cebcd170803bd8

    SHA256

    d9ed12bb004d92212a6f91c5f75ef873df762289ed32b261f513b22b8a547a93

    SHA512

    fa34ccad745d82ac44aa3a37beeeca8cee892ae6f5cfa538234f882ad44aeba3c0bbcc379c9a3372afe8c5222501c8eea2e9b8f03ef0c36d270958ae97472d7a

  • memory/2452-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2452-76-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB