Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 06:04

General

  • Target

    71d13e5a4b99749e4cabeb4590508ba0N.exe

  • Size

    75KB

  • MD5

    71d13e5a4b99749e4cabeb4590508ba0

  • SHA1

    e7cb66a0244d589fc69adb2beb81c3d9c2c64b1e

  • SHA256

    936efb6c1d949a7d292e2f624f007357f9a785b0fac3b3cf9cc0ff9e6549950e

  • SHA512

    21d5a28bda2151b39e782153f532d4247b1186eeb1e1174323444d8cc090d0802eb0208fe1040c2fc8084a48ed4988cac3ff6ce7f6f435dbef2f36e436887eac

  • SSDEEP

    768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXKqAJxi:a7ZyqaFAlsr1++PJHJXFAIuZAIuE

Malware Config

Signatures

  • Renames multiple (3089) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\71d13e5a4b99749e4cabeb4590508ba0N.exe
    "C:\Users\Admin\AppData\Local\Temp\71d13e5a4b99749e4cabeb4590508ba0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

    Filesize

    75KB

    MD5

    9c4f578fb775ddcaa36ddf1ad083e4e4

    SHA1

    4f7c0b05b6f98a40a5bcb36a2183f8cf774d45c6

    SHA256

    f2facae779f4a3ed1ace6498295d8d556416932e635dfb7d3484e9ce9c326af8

    SHA512

    bdccfc48de3be0b563bbd41f33bab567e070b2dbcf650182824de6b4cf61d8e5fcc5e5fa1cd7c3143d7d669e6fd905762ecb75da6efd40f8cdf5c1d672f90403

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    84KB

    MD5

    f57db3333422817fd9aa0587e373d101

    SHA1

    ce27ffbc66bb2c6d3811d29219b2b5aa8c14dabc

    SHA256

    9c68ff41ed36178a129527abf1b0b559e4be0ef2b002a94cbb2475ad56bd4754

    SHA512

    88ee95468e9989a9b13f6d7073afd419b921cebd4af5bd99384ed91e851e951877659a7d55eaf24a189864e048eb671d2d1860253377a5ca4b806dc547008510

  • memory/2344-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2344-68-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB