Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 21:42

General

  • Target

    5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe

  • Size

    51KB

  • MD5

    a608de1ca455536aca850f9b20e7e3e6

  • SHA1

    b426606a31e4cfb5271b4fa7be56191da3af2684

  • SHA256

    5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca

  • SHA512

    062e1ab5292bfe5f394de664d4b60dc3a7944b8f69adb0783f4ab303eed785cbfe6a4d083d5580ef99fcf3095817ce72bfc671db795e98fadd519ed3fa8b5281

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9nP/+c+l:V7Zf/FAxTWoJJ7TU

Malware Config

Signatures

  • Renames multiple (3729) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe
    "C:\Users\Admin\AppData\Local\Temp\5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

    Filesize

    51KB

    MD5

    3f7d5fcc5c2f666175e90859e3207d8b

    SHA1

    3f98eb32e172bd147088a418d65e9ed1c180dc88

    SHA256

    c727470ebce85a5b70db501b535b47a567c3981dd5ff394548878e443977aba3

    SHA512

    8ad70a22914429ddf44cfbd1005b39b1c5706377efc4b6cee59ea1b7a641a56ba0385f9ba2e7f6e6d9763bfbe1ea3a697ece0cc5b09cd40da7c1f020a42e1044

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    60KB

    MD5

    2c6e096c2cbd7bee026740670d262ea4

    SHA1

    40dd6d6912c6f74d0fe12a73c0a6f95e86d09931

    SHA256

    91ae983c87bc2c31d8f691de7149d1c201a3c2a06c0117b6cbddd26d3757edfc

    SHA512

    b03b48632eb44f79cf523342f024db1ce56c278061ce01e1278ff9e46f589cd078dc23d1e29fb8f599622308d04399037f26323396625b24aa201134914081e7

  • memory/2280-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2280-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB