Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2024, 00:34

General

  • Target

    78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe

  • Size

    64KB

  • MD5

    b0907e7f0d00fe6aa00e79d14fc040e0

  • SHA1

    b65a5a0560c1c7957f0dbd831ca9524b838e3273

  • SHA256

    78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315

  • SHA512

    9cc0f91a8d17ebbe62b87b7bfa40b1f6206740e8efdaf8409e90bbac478529b646f30bec1ad32a7a11efbbcad6ec6570eff257243c2f4c9e06e009aa5c772f16

  • SSDEEP

    768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEUI0n0uI0n05:V7Zf/FAxTWoJJ7TU3n0Wn05

Malware Config

Signatures

  • Renames multiple (3461) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe
    "C:\Users\Admin\AppData\Local\Temp\78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

    Filesize

    64KB

    MD5

    ec24af4f52c9442bad1cec63d0a748c8

    SHA1

    92dee1f8232d966fbe8f18784cdf8f7d26152a7e

    SHA256

    4c949c712916bf5d76b323e4ffbc5a221a26b86aacaa3512134cf7793fe9bc7e

    SHA512

    d6f5694464d9dfabecb7ccd1d650f6a5a711c80c561a7cf3a380b9a98c87de72eae17504163f2151f3b6283b9cf77df62c8bd9d926138d763c2a66259d5d4314

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    73KB

    MD5

    0eeef4f75d90014e3893eb16e9d65300

    SHA1

    cc6f195456f15f87c870e30466bd3b36573a7d5d

    SHA256

    aa6ef0577b734a4d44f1979f0569078fd14e61838bed54009cf77e220e984e96

    SHA512

    42bfbf33452fe21cb0f62af770e6952ecf4865f5a620d1b82472ce995d4578b52ba8ff1ab893f3eaa6addd7bb4bd1ac63d97e8172f0e3e3e71968935d768842a

  • memory/2816-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2816-68-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB