Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 09:39

General

  • Target

    b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe

  • Size

    53KB

  • MD5

    8b86c2a4e574351fc76dd3048902bb60

  • SHA1

    51ef262bede951fa5290bb9d897a6d71eea1771d

  • SHA256

    b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3c

  • SHA512

    5ed35c5041afe3b35df453f8207b92be5ce21caae12e8a2f59aa565ea713e511c4fc274b69498b055f2db3e25c27e295ec29adc1f3ff122cbfe7149e9263f37a

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEC:V7Zf/FAxTWoJJ7TUB

Malware Config

Signatures

  • Renames multiple (3165) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
    "C:\Users\Admin\AppData\Local\Temp\b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

    Filesize

    53KB

    MD5

    a44f58932c3e7134e37a8233e14ed032

    SHA1

    7a2fbdae40dd88495db238f66d032e7889ad0bcb

    SHA256

    a51b7d6054e2d5fbe19213196b3645b09f7b87cf9ee60dfe62f797622dc10433

    SHA512

    cea081cf0656d6dd022f8ecb920ca64f4c49f0f65fbf6e0cb68ede56c414a1248de44e6fcdd595ad08aa52e82912ec21f8a65a695243fcafa4646f266c904135

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    62KB

    MD5

    258c23314d1c87ebb02b7a73aa1da561

    SHA1

    bbd5b141ca9dabfe5fb8ca226e0668aab3953933

    SHA256

    49d93fe466aff6f50309e398e10a440a64a4055d5cb9462e90aaaab27c51a2f0

    SHA512

    31df00f6a4914e5dc93e249c3c19d3317b644ff8352079de2bc57ea627f9e932fd7d12e74ac38db0f362aaeae9a8a20a90deadd755fcc94844a051621aad4eae

  • memory/2916-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2916-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB