Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 02:43

General

  • Target

    a3496aaf6c7029b956280a6f21db5f1e8e7a6ecd4032e0eb128f6f0095b55425.exe

  • Size

    43KB

  • MD5

    efe08a229e3ac609c9b77f72bd70e2f4

  • SHA1

    ed5dafd0b387abcf93f2ef5a7737bb5992a18104

  • SHA256

    a3496aaf6c7029b956280a6f21db5f1e8e7a6ecd4032e0eb128f6f0095b55425

  • SHA512

    62b8c770815b041d95183304d1e8d678133a9c16f41fa811cd9c53a71f68b2ba32f47018cecba8e488fbc34af7bf7a1d58777f76e7048cf4c52f11765c259935

  • SSDEEP

    768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PpEI:CTW7JJZENTBHfiPpEI

Malware Config

Signatures

  • Renames multiple (3756) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3496aaf6c7029b956280a6f21db5f1e8e7a6ecd4032e0eb128f6f0095b55425.exe
    "C:\Users\Admin\AppData\Local\Temp\a3496aaf6c7029b956280a6f21db5f1e8e7a6ecd4032e0eb128f6f0095b55425.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

    Filesize

    43KB

    MD5

    885cafc4eac61f1c205b172baa8212af

    SHA1

    7e908db26c1feb63ae12de73c7c14bf5d62850b0

    SHA256

    072bed5128dca732e363c7fc33490c0b156e0032c229691148a2b97dcab8980c

    SHA512

    c8910df90cfa079ca7e5f4acd498f4988194d1a042791e5700d21f33a58214abe66c50917536fcc7e19eca731f0bba34541d247fd83094c48df67598dbbb2680

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    52KB

    MD5

    eec4d975a96e1b4a9224780fb47722c9

    SHA1

    5c2bfc3182164ed208b9b89034bc2fe4a40c0a96

    SHA256

    0a1bd1af77754b9ef3a20d3a5198e7d7a05dfe2d2285aae08a5a3504fcce6b86

    SHA512

    63d7ac54cd7c028f7c435d302fa95f74d2af026214401f1f271021256f8996f6eb5bdc07129ec6cd6cd74ee3c008fa93711ad09bee632dfe9ae6f262b0547262

  • memory/2824-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2824-64-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB