Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 20:09

General

  • Target

    d4b7be023366eb9208b993b3bb010500N.exe

  • Size

    25KB

  • MD5

    d4b7be023366eb9208b993b3bb010500

  • SHA1

    8a60f460b615f5773c31dabb65aff59433f34c45

  • SHA256

    721d5bad95e1b7783a012496ccc47deafba46d532719ad8752b49479caf42ac3

  • SHA512

    5ed3d03841e9be334cfa438a2d8c6c5ab310f399bcae26c8142a2ca29b7c1491b3b1d77b251bc7cc4b504d972b1b057c9bc2e5d8394d0692f3ae51a8e478b473

  • SSDEEP

    384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxmDEFE9rt:kBT37CPKKdJJ1EXBwzEXBwdcMcxrt

Malware Config

Signatures

  • Renames multiple (3448) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4b7be023366eb9208b993b3bb010500N.exe
    "C:\Users\Admin\AppData\Local\Temp\d4b7be023366eb9208b993b3bb010500N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

    Filesize

    25KB

    MD5

    1201689f546f4b0fe5526b3c47c0e5c3

    SHA1

    8dcb662348e2172bdb9ef20c71fce5b21603d8fc

    SHA256

    a3831c2ade3c0ebe65807825162e11e6c3c6e74f8b23fae41e93740a7b28e1be

    SHA512

    e4e5c32f84e6163997e317f271aa8b545107489d1bcf78af1c37419f670bbf58842028e9601fb16753dcab253353a87514f8a98b976cb356977111bc03b9d374

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    34KB

    MD5

    3fb4095fdf6a021a13631ed1e5f3cb4b

    SHA1

    fbdb804f4e93bedfd005529a3370555fcce06ae4

    SHA256

    10af129f1f9386fe44b270117e4c9e1b21fc910a06151a951b47357c36b79bbe

    SHA512

    083ba53ea30cb4c9f611bb26340741044e741560b37a5677d7fcf4c04a3c1b9458ce0bc10dc203229804f6e56d394222f59879e30032dba91543205ede8453b5

  • memory/288-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/288-75-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB