Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 00:30

General

  • Target

    293f91cf677120c68d9cd63e3e4052c0N.exe

  • Size

    48KB

  • MD5

    293f91cf677120c68d9cd63e3e4052c0

  • SHA1

    cdced02699667cd719240f806960c40a7d90861a

  • SHA256

    b5d770507ae29a489df7619bfc6c77be7a160be1c2b71a4af0b05d91407d25df

  • SHA512

    204b15092da769ef20e81f37a60d3d8122e599290ecf6ada7657be72874d916fdd46b7e01b08294161921d5e0d8d9cabd64d1e98468a0f8e42f97f9c1790bf5f

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9xt8W82:V7Zf/FAxTWoJJ7THJ

Malware Config

Signatures

  • Renames multiple (3130) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\293f91cf677120c68d9cd63e3e4052c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\293f91cf677120c68d9cd63e3e4052c0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

    Filesize

    48KB

    MD5

    242d58697f648d53e8049a98f9c524b3

    SHA1

    50dbc74dfef2b25af6275ead44416800195822d2

    SHA256

    4a8e4549ecfcc8ac6ee6b96aa2ad69011ed7ac56fb39b2dabd8029080ffa4fd9

    SHA512

    c3c63654d40c0c743b22d4cc1fea6c95006bb02db85b0cfb79d69a3279bb44fc785f8a502557c7422b193c483a851899e069c62a412e8a8a2b3bc5cea92d7598

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    57KB

    MD5

    255a83ea4bac41354c28646688f4cea9

    SHA1

    391c05ade5f210198a4979e1bfe4ed4875c8591b

    SHA256

    3cac36e42fdd8cd1d0a2cf06f73d6e2641041080208dbfe0c66a79ba2b87f25b

    SHA512

    f9f8b8759e54b6859c7d68393220bb5e741a9821e380fca8371aafc44fa9e6a5622edb32635d09a386400bb45b0c344b12c6faf17e61a6f3e8d073ab2f345f48

  • memory/2460-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2460-62-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB