Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 05:19

General

  • Target

    ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe

  • Size

    59KB

  • MD5

    28c402435c712dc6e82f573b9b8e5ab0

  • SHA1

    45c974c1b94ad5612d146897de7eadad114ba5fb

  • SHA256

    ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1

  • SHA512

    27b5a1886227b14fee14d303bb05227cfc58fe2a61b2ecd876f1d3668046aad0d85b9cacd781b2296330262c6911c5b7d5b8eb77e60c2b5097be6ae576956844

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZT+JZkeZrAJZkeZrP:KQSo7Zn

Malware Config

Signatures

  • Renames multiple (3285) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
    "C:\Users\Admin\AppData\Local\Temp\ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

    Filesize

    59KB

    MD5

    fd741c17c28b6da8d829e0bf982ea2c5

    SHA1

    4c7a994ab848deb15973de5b46114d09a8b01120

    SHA256

    f1b4b737aeda4cba9bc63b337f5ff4e1a484070ef371838ff6040b758f8f879f

    SHA512

    28c24804e6a5f57f36cd648049e298ee5e9a0ec404ee761c19144c0f6ed395f93e0dd5c6a09de2177382e89e9ec350247cd31be698f0e472bbbc4ee34c330cfd

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    68KB

    MD5

    d4f55c0990ca3828dd97577479b3847d

    SHA1

    366e42c378c6d23127c0164517efcfd72c8a1503

    SHA256

    fe18e2e1804c6342829dcc4226b8e14600da3f48820bed093c58ed117b6ce50d

    SHA512

    3b433626952626f4a434c17050a512d50eb50b43db42b5cc0e3ad17344479653fdbd6434cd490611f486d42176a641579ea26269f8175f4be629e2406f9dd985

  • memory/2572-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2572-75-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB