Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2024, 04:21

General

  • Target

    e6d742caae25ae7c6896ea123f80e371a0bc6bed1165fd48775c595313a931c7.exe

  • Size

    56KB

  • MD5

    3ac8475403bd96bad85ac9f6d40ef24f

  • SHA1

    f6557785c6305e5679d31a82a995b61fcca455ff

  • SHA256

    e6d742caae25ae7c6896ea123f80e371a0bc6bed1165fd48775c595313a931c7

  • SHA512

    014f76d1a67228ada2dc9efd37e07239459bf1c1858131ecfdc8586373e79319221f7824b214a8a81bd47731496c98b8fa44d18a18828ff73da8c8c47df09c5b

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9RJD0x1E6:V7Zf/FAxTWoJJ7TtD0/

Malware Config

Signatures

  • Renames multiple (812) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6d742caae25ae7c6896ea123f80e371a0bc6bed1165fd48775c595313a931c7.exe
    "C:\Users\Admin\AppData\Local\Temp\e6d742caae25ae7c6896ea123f80e371a0bc6bed1165fd48775c595313a931c7.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

    Filesize

    56KB

    MD5

    cddbb2f2e8a18ba7e8ab6f7d8178491e

    SHA1

    6264301b1c94bdddca009816c672ca161bbaa52e

    SHA256

    5f112b8d90746b794a0ddbca311288b6b8ba1dd0112ad9c96037913d5ccc1b1d

    SHA512

    1a3988d3238722bd8bae5da80972420e530ea81ed137168da0f30e11e70f74881e66e337e218e751ecc4d290c082522c3facf8585a52d8f7d7e1be2de9addc3a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    65KB

    MD5

    1344990cb0ec930a56b67bc1caa62372

    SHA1

    ab2eac58b66d1b134c4f29dd510b2fa981425431

    SHA256

    2266c41e490cd7f4768d4df6047ab119623cce9f15274bef3d30c71fc7c7b509

    SHA512

    ec74e88360fcfdc806173965003a9f3cf317619b88094ce35d94568bb8f29dd7a88e33e0abd9f1f784f8b877e366612486bf7c8201cc31e364681b913005921e

  • memory/2552-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2552-20-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB