Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2024, 03:01

General

  • Target

    8760ccb3d073a0caa863eaf6881f80b0N.exe

  • Size

    27KB

  • MD5

    8760ccb3d073a0caa863eaf6881f80b0

  • SHA1

    0f91972feb91c44bb09b287d39f90ce232eb1125

  • SHA256

    7698f5b35b8fd891e2b36cd64ab6e50916d91d029872d92e8d9891c4be52ebd8

  • SHA512

    4546500b04f809c267f045e3c1c041cf269c8a6c7c1b4fd772229203ba16bd21faa6abc2f16ebb5a26284ed7affdaa08f1b5174ff17ff98949dd4fdbab79c511

  • SSDEEP

    384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9oRf:kBT37CPKKdJJ1EXBwzEXBwdcMcI9oRf

Malware Config

Signatures

  • Renames multiple (3453) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8760ccb3d073a0caa863eaf6881f80b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\8760ccb3d073a0caa863eaf6881f80b0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

    Filesize

    27KB

    MD5

    392b7d81645a182107e4cd5c91da8531

    SHA1

    4e4eacd4c3722692452efbb21322ffb13dc0d2a4

    SHA256

    71bb0df3ce7e6f8f454fa59a7bb161aece0ce9a512956049f584dfcfe47a51dd

    SHA512

    7bfdf4f68347a980d2be767026bbb7f1f61ff81e7118d4aee831fde6c1aea7235761d99786c30c3668dc6d641a3647dc1ce6921ed74c859b4f1f3624849e9864

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    36KB

    MD5

    362809e2979d46456c5bd67fb48aa0e4

    SHA1

    9edde7d32a3c4b48fd7e13c091ffb840a2744af1

    SHA256

    46cf696dd0fda887e88d53303d50d3c9836b4bc6251dbedd679c4cf1e9e439ae

    SHA512

    5d55d43847dd3f830d1f52455da52e91dc7f6fea9b322b40539fd07c09c7a57aee97edd1660c236bce7b324359e3ba95a51028498af37705c944413959d2eb6d

  • memory/2976-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2976-75-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB