Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/09/2024, 10:52

General

  • Target

    77a0d9c8ac29df3229cbaa9738f77340N.exe

  • Size

    80KB

  • MD5

    77a0d9c8ac29df3229cbaa9738f77340

  • SHA1

    e120df75e837a84a532af69162306968c22a1ea7

  • SHA256

    08f7a84b4bfb8ebb081e5bc2a98fd3610e7e01ad6d0e3cb13e6536632e636508

  • SHA512

    dce5e7aa2a97df7cafdf56ba230fafadf75334eabd27d7fcc1a2a5189a73c87cc4745a473b9d89a04eeb392d0dacdf4e97fca5d9067ebb7033a7cd25b9a30ad2

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTj:fnyiQSo7ZP

Malware Config

Signatures

  • Renames multiple (3266) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\77a0d9c8ac29df3229cbaa9738f77340N.exe
    "C:\Users\Admin\AppData\Local\Temp\77a0d9c8ac29df3229cbaa9738f77340N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

    Filesize

    80KB

    MD5

    a0dec44645bb86ba6980fda62d0cafc2

    SHA1

    2812005381f4264c8ae411f9c3dc8e287d7a5376

    SHA256

    056f5ba135c3cb52be3304ebead93010981be6c103ea0be4ee102d6d0c730efc

    SHA512

    7b3de7cb45ccc26665482468a4fb40701d6871dd2faee72b5c5979461572b94db9af0485e7699628f8566ad3075881476cd0b1d75b9f205066cb7592ac47957c

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    89KB

    MD5

    919c9cf5ff46b1f21db98bc2084f2a15

    SHA1

    9de14142c47e571667dd7bed6c9da9ae3983422e

    SHA256

    cc7fcc0a1ac830808e5105926ba5b3305aec4ccb29a8787eb663a0e9c6c08eba

    SHA512

    a4b00ed17fe66ea349aace43b2bc68d1b191b8bbc617cdffb4308e7419bddc6be1d4ecbd65d336e642395ffa5c431a90e742701a16ed7e98c3677a07bf8a5d1f

  • memory/2488-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2488-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB