Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 01:30

General

  • Target

    c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe

  • Size

    83KB

  • MD5

    c44dda680a23d1030ba57dc9360eaa40

  • SHA1

    402c0d0d64c6b1dc3e7314ffafcd8affe128a9dc

  • SHA256

    c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fb

  • SHA512

    7e84a42c7a41a648ddbdbd8d41860dc9555efacb653e2d2380d74756f14660a8585de1efbe4cebbbd81f24e86e6c6f878743ebce936f4930cfb98d89e0104d3e

  • SSDEEP

    1536:V7Zf/FAxTWoJJ7TKyXKoyXKoTW7JJ7TKyXKoyXK3:fny17KdKv7KdK3

Malware Config

Signatures

  • Renames multiple (3459) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe
    "C:\Users\Admin\AppData\Local\Temp\c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

    Filesize

    83KB

    MD5

    ff21cce286b20d9d88616da424cc22c4

    SHA1

    7f37ebee1d8709ff08ddf8c32170238788ee6082

    SHA256

    edc14cbb252b24a0a2645488224ee4cbf90beee9d8424603f874d03727171ead

    SHA512

    b0d174a9a038068bbb281255f0733d6f87ac9893b273d9bedf943428eb573b6f7d516c755662d6055c5c2a490e1654fe2433022dd2621e987f700c38952d1895

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    92KB

    MD5

    51114577d3b8988f0a86addf49cc9635

    SHA1

    418119acc16f472cfb7eb45731f6d96f7b3dfbcf

    SHA256

    034e0f8884e4984265a99136f2f2ce0ded25799ebe7af596598fc1aec9a77c20

    SHA512

    71fee683c508bcdbd64d644be44bf838e027b78a38f40a5cc5af26b69bfcd964c02b09faf04455122158a0580f088841a846e24b885727197421bc95032911c9

  • memory/3068-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3068-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB