Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/09/2024, 05:12

General

  • Target

    54bcb7283519e9d6deb17c5e4e459080N.exe

  • Size

    72KB

  • MD5

    54bcb7283519e9d6deb17c5e4e459080

  • SHA1

    bb2b194e3247f746b56a74e28c77121ef2718ab2

  • SHA256

    bc1959566c82a4461153bdc49d86b5b5d42df1c836de40dcfff29cba5d14d751

  • SHA512

    808b3966a3003483172aedf67451a6d95a992ee988fb5ac8fa7ae0efec0c104c3aad236be9a7d32b7085ebae2dd4ae23ac7f235348dcaaaeeac927ab6ff1f035

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8zx4LgLGiSIu2ViSIu2M2v:KQSoFcSG32v

Malware Config

Signatures

  • Renames multiple (3121) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\54bcb7283519e9d6deb17c5e4e459080N.exe
    "C:\Users\Admin\AppData\Local\Temp\54bcb7283519e9d6deb17c5e4e459080N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

    Filesize

    72KB

    MD5

    7709b17038995b2a91e4024039791747

    SHA1

    2c910da9aee11440b22dc94f8abfe92fc8ba0e67

    SHA256

    a3266c0121fa95496951db2d64e3d505d4079e3d3f40ee72898f512d7ead67ac

    SHA512

    7df4f609f07490503fe53fd976503a3705a55a330dbcefb5540a7ea62f7f112e08a2c2da2dbf998d28776bc95b971ea08701b080068ea619b068b355d3913e60

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    81KB

    MD5

    87b506ca9b76fbc98c9dcdf1fe75d5e2

    SHA1

    048e54df6ab1d317a846250a94eed5859f55c367

    SHA256

    1b1d996a81fb3755dc0b26eb46da75b452e242a2958d7f1d28f90aec3d7427f0

    SHA512

    fbee1096aaf547a01bad923b17197d9cfa67d5ea7efaa644d14faa37aff322b33315b0335504a522b49918565fe789dde3788f2d8cd3791ae6ddfb2e89288142

  • memory/2236-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2236-75-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB