Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/09/2024, 20:24

General

  • Target

    892abed12f68b601dcddefc7ab831ed0N.exe

  • Size

    53KB

  • MD5

    892abed12f68b601dcddefc7ab831ed0

  • SHA1

    dba3b76c6a5b331e0c7eeadb6b540833a649e652

  • SHA256

    1421c92e27ac6dfb30fe35c219993412de7f1f541adb1634d078cf975a78b5bc

  • SHA512

    939a55a2f35dcdb5b6276f15cf85ad55f9c3f007f2aa6da07ad51fa8951a9e30fa2e80bebaf3fb14471d8c0d1dc3f509568a12fed3f3009388fe6f119a865c65

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBKqbKt:V7Zf/FAxTWoJJZENTBKqbKt

Malware Config

Signatures

  • Renames multiple (3162) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\892abed12f68b601dcddefc7ab831ed0N.exe
    "C:\Users\Admin\AppData\Local\Temp\892abed12f68b601dcddefc7ab831ed0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

    Filesize

    53KB

    MD5

    d242de177153cb3dac6f827e1ad5a854

    SHA1

    2ea1c0a2c0fe808feda1196687b808a5bb6eb146

    SHA256

    bb42476e443030fa0c67204b7c9700c39c067a48b98ddb819bae9a1b92bd8a65

    SHA512

    1c5e48e2452938aa30da3b520060abbf21e7dd9a0733c09bb74e42e721a7f99ecf164e4d2ef2acf6e4ccd424c56dcff14828807a29887413910fc0c659e62a25

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    62KB

    MD5

    4247b9da2e168bd06d614875680bc35d

    SHA1

    c5609c25da800435b680231de8cb2f52e4ab3182

    SHA256

    9186f9cae98698f1a81ab92ebf633fd041f07b99f90c45426bd5115b24c7aba5

    SHA512

    c372effebb21d23c130abfa1283bf539fe2b94a2a1730262eb8afa62adf9e4e4a589a3e497b08891e685f165f2449e8ee8cd0a37a168b5f299b534e5c38e8c86

  • memory/2072-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2072-68-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB