Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 07:07

General

  • Target

    f47ea9b4133d59f3384b2ded02f4afc0N.exe

  • Size

    44KB

  • MD5

    f47ea9b4133d59f3384b2ded02f4afc0

  • SHA1

    f6b2eb5b9745d3da4e157ae36f9dc2a695c90e57

  • SHA256

    d9a067149f8e9a4bb79b4322f66c5b86e21244b223a95337256838f760a6b16d

  • SHA512

    198dc0543cfcc2c18df0a0388e374f8685f7d508f8df6f1bbab5b1bcd60189fe32a68b38d7c9d19d73010e6c06a358571f4f3ff0b28efec9df4203a00eabfc51

  • SSDEEP

    384:FBt7Br5xjL2Kd5AsAoh6n5eaOlIBXDaU7CPKK0TIh6SjeYDTcYDTkZW8b88:V7Blpf/FAK65euBT37CPKK0SjeQ8

Malware Config

Signatures

  • Renames multiple (3268) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f47ea9b4133d59f3384b2ded02f4afc0N.exe
    "C:\Users\Admin\AppData\Local\Temp\f47ea9b4133d59f3384b2ded02f4afc0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

    Filesize

    44KB

    MD5

    63f7def9945ebfc91662c711f52788e4

    SHA1

    ed2f94e4c9930d1642b300d2e2e18fc2658e8b15

    SHA256

    2618685801b1bf1cc66d444a29dabc856a3ea7985eaf004f3edc04d52c724b76

    SHA512

    04a21060dbd74ee24a831d1b55e6da64eed1a6d6f91172109c20a38e1ca8f881d87a6abb53c00381a95a8dc7b41daa1213e50b69a246cf301f08a4a22b6f9c2f

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    53KB

    MD5

    01880c17c747454f00faf7bea7312db3

    SHA1

    bdf5c48a0882d2ed09faa428636aa60a7916903b

    SHA256

    6041b5a20da1e6d13e481d63ed8ffa93def28561077bcb24ce51dd53f821ceb5

    SHA512

    1e09abe08fabbb250ad16e5412966db0fc11712e64aab42f53073d9dfea3b944dca92ba20fc808c446fb093eebb82d33405da63d3b85844614d8430c331ea1ce

  • memory/2384-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2384-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB