Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 20:08

General

  • Target

    d0a396eeb4dc945da685a2e5d16a8cd0N.exe

  • Size

    51KB

  • MD5

    d0a396eeb4dc945da685a2e5d16a8cd0

  • SHA1

    941f7bc910fdce2828e2613fe53311fe753025f4

  • SHA256

    411913cbd6151bc4efd8fa3945e9b624892cf4626f9655cbb1efb98c648bf9ec

  • SHA512

    3a9c6f239d7f13e0b7b4701a0484c8c2d511059dae7a62235174712b361877a4174ebf25235001e1ffbf4f0e75605fb25a15c266329523aed1b8c27d01ef5507

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9GRtfn:V7Zf/FAxTWoJJ7Tofn

Malware Config

Signatures

  • Renames multiple (3213) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0a396eeb4dc945da685a2e5d16a8cd0N.exe
    "C:\Users\Admin\AppData\Local\Temp\d0a396eeb4dc945da685a2e5d16a8cd0N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

    Filesize

    52KB

    MD5

    bf775de880dc325c14ef4dc43042a8fc

    SHA1

    3c915504ba1fc03dcefde3179c0f0015798cc33e

    SHA256

    04668040aceb8ba4d61194685fc4f17fe41bc77b71db39379317965f8c6a0fdd

    SHA512

    1fd5d4c974036fc05bf5567f2160e88cbc1ae7d5cf7b840993fb3e326a7139e2ceb1268ecb9dd737ae98604b06c1f3498af2c8bdd510074611d23968e9b1a2cb

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    61KB

    MD5

    3f46220ae36babc32bc7a6458ea7ea7c

    SHA1

    5d67635af4019791adecab65eccd816786f614f7

    SHA256

    cc64f98f39935f9784cdba1202c79782a340cb9eeb74094eb9ee45eafa3dc155

    SHA512

    05e2fa6c40fc61dd319785c6869365d79f73ea3c328ebb2edc5995b9d59ab09e55c917c84b3306c83c731e3d8600d18043b01c4756ce26ca234ef23f8952679a

  • memory/3024-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3024-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB