Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 12:56

General

  • Target

    ab09fa6ffde15530935106f67d2b4090N.exe

  • Size

    25KB

  • MD5

    ab09fa6ffde15530935106f67d2b4090

  • SHA1

    2bb3356c7e15251f838455d4815ac74697363bda

  • SHA256

    b524e3ed3bab2f1183b2a1e4c132992b7b42dd3fbb120a6ef2920c7ab899c99a

  • SHA512

    e9f07b01990b596deb445cb0e3a31694c62a45f77db6b6c88f64bf4ff439f92a47d3bb093bd7c10517b6e09fafb5e239c32734cf8d23980d8c467641d9538cc9

  • SSDEEP

    384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9O:kBT37CPKKdJJ1EXBwzEXBwdcMcI9O

Malware Config

Signatures

  • Renames multiple (527) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab09fa6ffde15530935106f67d2b4090N.exe
    "C:\Users\Admin\AppData\Local\Temp\ab09fa6ffde15530935106f67d2b4090N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

    Filesize

    25KB

    MD5

    1c954e9a98d578f3a2d565cc648eebab

    SHA1

    6381a714e96561ccc942a8156a1b069084337ca1

    SHA256

    dbc6224bb1eb324c19d09f06a24c954dce1691b8131f2d2ac5691b4a1638a9a0

    SHA512

    f089ac9d11f633f0fd99f954d3478a292c4c9030113219885bb7871add50ae840247d56fdab0166fb7ba7c25d484c10cc2b6c62a26c6af7389f9a43d256126c8

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    34KB

    MD5

    bc5d5ba105672b509311116607207cfb

    SHA1

    b816e0850dd96b19af8130bddf46aed3c55d8335

    SHA256

    8afe11df3c91f80c74d2223c2ca3da3f17b342549006b7f5ed06e38e4036f4ed

    SHA512

    d2f48b89b03bd1398caac5b849e33b7e099083138b63c09af28bbd822f6994becf9679b7926545e163f62294730975cc551c4db3665e34748c25ade3297497a1

  • memory/2388-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2388-26-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB