Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2024, 11:15

General

  • Target

    f61bd9c4837ef0b2926c7c84e3ab66ac151a13490079c471371b2be72fda3724N.exe

  • Size

    83KB

  • MD5

    29788e070aeb0bbcdfbf433c83be1120

  • SHA1

    516c877eec2bd270e25b8b86d98bc78d98f2692c

  • SHA256

    f61bd9c4837ef0b2926c7c84e3ab66ac151a13490079c471371b2be72fda3724

  • SHA512

    5f13093b72a14f2a7dc8450a9f1dff2eb31fcbd4a301f93aad5c40ce0be058efe5990ea778c93b446de43170208d6117738bfcb09cf4f31d79fef071ecd0c925

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+/K:LJ0TAz6Mte4A+aaZx8EnCGVu/

Score
5/10

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f61bd9c4837ef0b2926c7c84e3ab66ac151a13490079c471371b2be72fda3724N.exe
    "C:\Users\Admin\AppData\Local\Temp\f61bd9c4837ef0b2926c7c84e3ab66ac151a13490079c471371b2be72fda3724N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-dSGHQuUj9BoKKoOp.exe

    Filesize

    83KB

    MD5

    3912516576f075afc86fce8d09275555

    SHA1

    4b8807b32f79f4e1303fd5f9e42de746bfd6f727

    SHA256

    dc778d58cdaccc1efee436bdda4f6b38208bbe000ae82db93268d2c10f28ca23

    SHA512

    dafafda9edf64a1a894f8f22a6e0681514663a5f6a87ab887a5f4396b1139e5f92c7f1bea0b6ef955c1bb1c917e76d9e288979ff37ecaf4d4c05503eae12484a

  • memory/2572-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2572-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2572-5-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2572-15-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2572-22-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB