Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24/08/2024, 09:44

General

  • Target

    d1ba777bf479cdccf599fc549e712050N.exe

  • Size

    85KB

  • MD5

    d1ba777bf479cdccf599fc549e712050

  • SHA1

    fb00eec7d51370cc56d9a512b8e55f8d2f4456ff

  • SHA256

    8127ddff59c77b2719b2b9b0fd25a9b9b38073ce545bc9282b96791e245729cf

  • SHA512

    406ecb955b90e63c51182a89bb16276f248e77ba4832b5c7aa0d0eafabae298edb146215d4e694736d1c19376d642c44ab7c3f92b87f5f755a1ac319be4adf1c

  • SSDEEP

    1536:V7Zf/FAxTWoJJB7LD2I2IbSaTW7JJB7LD2I2IbS0pW:fny1tD33bS5tD33bS0pW

Malware Config

Signatures

  • Renames multiple (3034) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1ba777bf479cdccf599fc549e712050N.exe
    "C:\Users\Admin\AppData\Local\Temp\d1ba777bf479cdccf599fc549e712050N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1200

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

    Filesize

    85KB

    MD5

    3ff2803a65bbae16196a21a23e4e5609

    SHA1

    615af1951cbaec12ead1dbe92e6cb33549a5fdf5

    SHA256

    d8d63604232e7a69b8a3d982152fc571fb8e61058703ab9086c8c22d8e3d343f

    SHA512

    445dcb17618914aff84b235c91621064efae5d7028cb5762050afb5c8968645e028b7eb783e349c266df04c9040b1f47b21e6f10665ee582ce30c633cde717db

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    94KB

    MD5

    a5e78ab46f86fc84f999974eef4fce20

    SHA1

    2977b848c2a8f99ace41e9e233dfe4c4547bedd0

    SHA256

    9591b278f58894368556197f2d8fba6659eab48f94c454f3e52a28122582ee82

    SHA512

    8e765e4216f0c8e9825f3f244fb36948b6d092e37b30b0389b9f4b0ebe63c919123d21eeccccd9b7ad46fa385788be6f2b631ce22da40c7df842597fdd7e2d1f

  • memory/1200-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1200-68-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB