Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2024, 02:47

General

  • Target

    4a30a6d7f6afeb7d816c8669df998880N.exe

  • Size

    71KB

  • MD5

    4a30a6d7f6afeb7d816c8669df998880

  • SHA1

    670392a3afa3790f8ba5efe99c9b0c8b4c99bde2

  • SHA256

    3deeb2b2878a8782d5e29d4d5b41e0795e30f5998ffb514aac20a5b5cfd5003a

  • SHA512

    61870d157f1e1c2b0d1b220dafec444735c015c0b9f36982eaa5e96b19d2d648485dc19fc2eedede389577cf755f805032deaf7b2a1abda44e16e518e7323d8e

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9CBT37CPKKdJJ1EXBwzE4:V7Zf/FAxTWoJJ7TiTW7JJ7TtR1

Malware Config

Signatures

  • Renames multiple (3192) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a30a6d7f6afeb7d816c8669df998880N.exe
    "C:\Users\Admin\AppData\Local\Temp\4a30a6d7f6afeb7d816c8669df998880N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    72KB

    MD5

    17505ba5de18902dc3dca5550f041fae

    SHA1

    4b4dabbe1d218763e721e940ccc3156fd038124c

    SHA256

    889d951be7d4854fe4edb53de6b175c345779b353aaf42e76be05e52d2a61af6

    SHA512

    5e56158fab60a9f6659a9531fdb9ca95c37d1aceb9812f90d6922457bd5fc3aa8984aafcc42b03bc58ecd5e1ad397d41487d9028643be45c765a882c0c1e3a14

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    81KB

    MD5

    76632d0be82d0ac65f7d90c9a3aff381

    SHA1

    a62341aab6dfc7c91a92841226217bea234116ba

    SHA256

    e10275053eb2fcffb6e7573e3fef0055b91c668db18fde63e410ad38018279e0

    SHA512

    4234a5369a1a9016ae7e868791ebd2c76fb4cff801b7c8f55214117880f5e1cd4d2162717edca13927a8faa4177652f6575317b899d65cacb68b8a3a5965ee76

  • memory/1780-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1780-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB