Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 05:25

General

  • Target

    eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe

  • Size

    34KB

  • MD5

    81cd2bd6725ec35ecf079fede8cea375

  • SHA1

    0fd62c2ade96f78729967a265c9e0d3d59319b5f

  • SHA256

    eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c

  • SHA512

    919c478dc0835773e99d180ab743743d6700de80da8246c1411f137efdca767ac31979079d3855532ce77ba1ce3b822c5acbc58e8eca2dc8e8a2d1cc8a288ba5

  • SSDEEP

    768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9lBT37CPKKiUv:CTW7JJ7TdTWx

Malware Config

Signatures

  • Renames multiple (3813) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe
    "C:\Users\Admin\AppData\Local\Temp\eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

    Filesize

    34KB

    MD5

    37e1bcb5b6b384c38d95d051762475dc

    SHA1

    22892a65bceaa2640858973cb7f4c754e07aa9b3

    SHA256

    4a713e26c3530dd3380a439389b156cb7e72800990062ed15cd0b3e8cfc44cc5

    SHA512

    2c4083ce004617e21afc515edd9c4fc37e48b705f67b1ed74bb8d6738cd02b06c0d6bc5deed7fbe1dd36b988572ab8550ba4ccfe864ff5b88ab331cc6c1efa3a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    43KB

    MD5

    673d4ed12f7affb7bf9fe55f9d8d3284

    SHA1

    cf939934cf9d0311275471eabdb274b0027d5ba1

    SHA256

    742b23e33e9aef0cf5c29769c3bf5f94ec8a3e27a81ec3e95170ebf82b57dcba

    SHA512

    14718d19ec137a905332f23ee90fb0bc83b9b4a15e97ae4193e4842ec01318992f97c6c2cb729fff94e4bc6f6d6c3070b24b6271a227402882860f4fd3bc1f5a

  • memory/2028-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2028-75-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB