Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2024, 00:31

General

  • Target

    78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe

  • Size

    64KB

  • MD5

    b0907e7f0d00fe6aa00e79d14fc040e0

  • SHA1

    b65a5a0560c1c7957f0dbd831ca9524b838e3273

  • SHA256

    78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315

  • SHA512

    9cc0f91a8d17ebbe62b87b7bfa40b1f6206740e8efdaf8409e90bbac478529b646f30bec1ad32a7a11efbbcad6ec6570eff257243c2f4c9e06e009aa5c772f16

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEUI0n0uI0n05:V7Zf/FAxTWoJJ7TU3n0Wn05

Malware Config

Signatures

  • Renames multiple (304) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe
    "C:\Users\Admin\AppData\Local\Temp\78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

    Filesize

    64KB

    MD5

    491b61a0c79f6cdb85a2c834f2604f8e

    SHA1

    5626a511f3e9bbdf6f5fe96f9249058349eca5b0

    SHA256

    08388fdbe21c5b3fadf15a1f7b52f2d5d961a9d5fa17f34e3bfcada7f894a335

    SHA512

    78ca7aefa815e209c9d7de3b144c2e374cddf44e6abc9f2a4c3cd45a803ce759016a3da190f55d755754f21bea9dd1b4bc67e36ad3e61e10a775d63a190d5e74

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    73KB

    MD5

    899151399eba821fbe34dcf120ae5bc1

    SHA1

    4b63f6860f3e685f181218e6858c33bb5385ae0d

    SHA256

    faf20e09d43366105c2a13ca9ebec8650534cb43839d62c57b541fabaaed6c3e

    SHA512

    10938f17ca9492405db262c6427a88fe9e7f77cdb6e30dad6ecf7db9f8a67e23e5d052b584b02087c1a52d8dea34e58a6976def83e184d5d9d97ed27ca99ed9b

  • memory/2396-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2396-20-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB