Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 10:00

General

  • Target

    ef33cca6c657b0841236c1cf3157c8f0N.exe

  • Size

    54KB

  • MD5

    ef33cca6c657b0841236c1cf3157c8f0

  • SHA1

    17ef73bf2e2df47a7dd6fa990e8de74565744a00

  • SHA256

    321a3d99805bad39358f205b6a6384a67ee775be5a4d4c6b601faea89a83a86e

  • SHA512

    cde97df4550e0515cfa2a30ac541a1ac4baeddf2680f168fa7407e3b8bee00983153eae684e58e893a2713e5e0356f0daa5d0bc895c8a46af836ce95b73d255d

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9bJSsJSCQZbQZw:V7Zf/FAxTWoJJ7TFJSsJSBcw

Malware Config

Signatures

  • Renames multiple (3419) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef33cca6c657b0841236c1cf3157c8f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\ef33cca6c657b0841236c1cf3157c8f0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

    Filesize

    55KB

    MD5

    22938899df799ecb737cab144eb0abb5

    SHA1

    3f0cd4ef7f3212d61ab43e2b4a71970677e4c6e6

    SHA256

    c141011a4e23ed61cd43585437f73911da98cee55d47ceb5a7fd4b7fb4390a74

    SHA512

    393d78e67a5f1216be7de307ad00ba86a261f8da754648c19386bc2f5485d258257cfc18cadd034c492447254f3f7bd3177bec809d8f56d2bc6d6cdee602decb

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    64KB

    MD5

    37179079dba153f93a690607ebfd23dd

    SHA1

    5c981006a9b56866afd9e9c3460b627d0ddc5fb9

    SHA256

    613521fe5a224a84631c3089b37607e2234d5153497772c85ef35b48403e7f6f

    SHA512

    4e1961a5e237909a1f426a5ded20aa3b2b4c0d7b17e61f9c768be4dc17dc64c5707bf477379bbd1cff77fa7ecb9d9f24ac4d00f0efe2d73cd1583a28bf3dcb04

  • memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3000-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB