Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 03:17

General

  • Target

    06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe

  • Size

    61KB

  • MD5

    ce7356ca32b462082067b74c220102f0

  • SHA1

    a62a4dbd4343b4c76aed07c510d3a586566cd94b

  • SHA256

    06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28

  • SHA512

    d97bb779ad69a5a148baf386e51753b8afd7e63b8e92b5bb9b814d326dcb42338128ef6e9eb2986311fb92dfb354bedef52e1c32a50e83c527aa4f9de95e0d20

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Hx3R9pi1xOR9pi1xNXVA:V7Zf/FAxTWoJJ7Th9ko9khFw

Malware Config

Signatures

  • Renames multiple (3151) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe
    "C:\Users\Admin\AppData\Local\Temp\06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

    Filesize

    61KB

    MD5

    05cb4ab19ef6ffbe7972990acf5e5351

    SHA1

    d774fd404b28dc524e40da75427bf46799e832d3

    SHA256

    2a7ccc3388d08cbd36f5aae8e3e1eb69e608db801523cf8e5f45771956e68455

    SHA512

    d66f642f6783132d71a910e4eade253162a483ed4984800b3decaa12d75d535bb652472cd9588b34cab41addf97b5054ea250cfacd3962aa3a84556c700d5f29

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    70KB

    MD5

    91600f2daece230c2ea45247031c4735

    SHA1

    fb1a7a82aacca7676a0d2aa573eea5750a6d5368

    SHA256

    60eb12791bc14b736bd81c8b0e1940933a6312fc0dc3be9e94c9f33c4a843dcc

    SHA512

    c923b714b18efbd9c087b9bcd34b4a9e53e1cc7a51157afe2239e3dc75fab9b8e135438b0303936ad94bd7b7824fc6c380b08ffa9782172fd6dc8b671e58de3c

  • memory/632-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/632-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB