Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 22:07

General

  • Target

    6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe

  • Size

    54KB

  • MD5

    479ee7515d94af8d5cb72e02f46f2b2f

  • SHA1

    be6fc444e5b2c39a5ec12e2ccff3f31c83b46129

  • SHA256

    6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6

  • SHA512

    a06c5fc92b67e45e95bbf26da0191d759f0921b28e566dc4add0982557d753f1496f1393f2438f00a8a5fbef7a5a748961bc8ed4c19aab51e0cd9d815457a552

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PU+:V7Zf/FAxTWoJJZENTBHfiPU+

Malware Config

Signatures

  • Renames multiple (3875) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe
    "C:\Users\Admin\AppData\Local\Temp\6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

    Filesize

    55KB

    MD5

    34097b1896b39f72cb6f704ebe17b17b

    SHA1

    1f178dd65cc38af8ba5d3aef8f8ec5d031301f05

    SHA256

    5e6659c7988dcf81c5288b6f021a355041fb4a8ccc5c5dde7d81be8458c098dc

    SHA512

    a869e70638225cb72a0c746c5bce1f2e6acfb31d39563a608b4a8ac8b51caeab0781cb19036fd82abf84d86c0487e7b029cb03d5beef6ee7010eea18b6b8e5e4

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    63KB

    MD5

    f8cf032339e8404f69cacd2daf305078

    SHA1

    30cf8b14988439ba0035c5ed1a6755f1882f7287

    SHA256

    d6dbf8e58fa50f983f56988086f8ad92a522d4c458880809af125a25511372ff

    SHA512

    2f44ace8c0b8780e420aa18fc5e99b06beef54378ed2e38c59a58d06617cdd163c83ded54f4883544e1f1550f68554bbeb20e7359b6810545a4bc2c2cc6cfd62

  • memory/2264-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2264-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB