Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    22s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 15:17

General

  • Target

    61c0f8e3b8f52b25b53124606379b77f0abfc8531ea93baa483782d3ad035665N.exe

  • Size

    85KB

  • MD5

    a6df750a9e496a7bcd7de8e146d6ddd0

  • SHA1

    10453f508a6cb66f2d991c4d25cdeff353b481c7

  • SHA256

    61c0f8e3b8f52b25b53124606379b77f0abfc8531ea93baa483782d3ad035665

  • SHA512

    7a9d61bdd773a28c195fbd72c02ff8dac73e26c36b16f6c95170323156ecfda257b295159133e923de0f8d53d5744ec13204a43c5a2eb68e69d1a83ddc009230

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5+XI:fnyiQSox5+XI

Malware Config

Signatures

  • Renames multiple (2859) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\61c0f8e3b8f52b25b53124606379b77f0abfc8531ea93baa483782d3ad035665N.exe
    "C:\Users\Admin\AppData\Local\Temp\61c0f8e3b8f52b25b53124606379b77f0abfc8531ea93baa483782d3ad035665N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

    Filesize

    85KB

    MD5

    36cd2dc9d0984e3f1c95792632a91f36

    SHA1

    919d67312c9abb0a157514ad2ed0ae3ae2cbb117

    SHA256

    d6e073d941715b84a359ed025462bdf7c8adead1c1d5dd2be1ccc00f1dfa6092

    SHA512

    890277f1126ab06a6efef980c19bcfc128a05b8d479c6baa90f299e8d0a5d6aa97fce5b96d3dbead649a0ea58cb45b5cf704378a2878a3d57e8ae989d5eea47f

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    94KB

    MD5

    7621eb4d507e34c4facd4a5978ffa112

    SHA1

    3721aae5e195972f700f63a22d35d43f002d1714

    SHA256

    3b5e062c170eff53d69bca49d5be394743fb2bbc1c89babf7dc910dca7cc0ad7

    SHA512

    6ce078fbc0f43e563c700c9fd6fd72aa71bcece8cce855ba0294f8a0937b13a5a6712190f2d0639177baacf71965b1235ddc695f732bb1eb3f2388ea901bba81

  • memory/2656-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2656-68-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB