Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7GB_b19741fxj.apk
android-9-x86
Norican-Regular.ttf
windows7-x64
3Norican-Regular.ttf
windows10-2004-x64
7Norican.ttf
windows7-x64
3Norican.ttf
windows10-2004-x64
7YOWA.html
windows7-x64
1YOWA.html
windows10-2004-x64
1changelog-ar.html
windows7-x64
1changelog-ar.html
windows10-2004-x64
1changelog.html
windows7-x64
changelog.html
windows10-2004-x64
1cl-message...erties
windows7-x64
3cl-message...erties
windows10-2004-x64
3clockDarkTheme.xml
windows7-x64
1clockDarkTheme.xml
windows10-2004-x64
1clockLightTheme.xml
windows7-x64
1clockLightTheme.xml
windows10-2004-x64
1credits.html
windows7-x64
1credits.html
windows10-2004-x64
animations...6.json
windows7-x64
3animations...6.json
windows10-2004-x64
3manifest.json
windows7-x64
3manifest.json
windows10-2004-x64
3ic_content...on.xml
windows7-x64
1ic_content...on.xml
windows10-2004-x64
1ic_content...ck.xml
windows7-x64
ic_content...ck.xml
windows10-2004-x64
1ic_content...ck.xml
windows7-x64
1ic_content...ck.xml
windows10-2004-x64
1ic_content...ld.xml
windows7-x64
1ic_content...ld.xml
windows10-2004-x64
1l17846d7a_a32.so
debian-9-armhf
1Resubmissions
06/07/2023, 18:35
230706-w8fqlsdg43 706/07/2023, 18:32
230706-w6mfdadg35 706/07/2023, 18:27
230706-w34kgsdg32 705/07/2023, 09:21
230705-lbqjfabd66 705/07/2023, 08:59
230705-kxxdfach7v 705/07/2023, 08:41
230705-klwmrscg9y 705/07/2023, 07:15
230705-h3aqhscf6z 705/07/2023, 07:13
230705-h2e9lsba95 705/07/2023, 06:50
230705-hl6fvscf2t 7Analysis
-
max time kernel
265s -
max time network
298s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2023, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
GB_b19741fxj.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
Norican-Regular.ttf
Resource
win7-20230703-en
Behavioral task
behavioral3
Sample
Norican-Regular.ttf
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
Norican.ttf
Resource
win7-20230703-en
Behavioral task
behavioral5
Sample
Norican.ttf
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
YOWA.html
Resource
win7-20230703-en
Behavioral task
behavioral7
Sample
YOWA.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
changelog-ar.html
Resource
win7-20230703-en
Behavioral task
behavioral9
Sample
changelog-ar.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
changelog.html
Resource
win7-20230621-en
Behavioral task
behavioral11
Sample
changelog.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
cl-messages_en_us.properties
Resource
win7-20230703-en
Behavioral task
behavioral13
Sample
cl-messages_en_us.properties
Resource
win10v2004-20230621-en
Behavioral task
behavioral14
Sample
clockDarkTheme.xml
Resource
win7-20230703-en
Behavioral task
behavioral15
Sample
clockDarkTheme.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
clockLightTheme.xml
Resource
win7-20230703-en
Behavioral task
behavioral17
Sample
clockLightTheme.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
credits.html
Resource
win7-20230703-en
Behavioral task
behavioral19
Sample
credits.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
animations/lf30_editor_cjab5ej6.json
Resource
win7-20230703-en
Behavioral task
behavioral21
Sample
animations/lf30_editor_cjab5ej6.json
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
manifest.json
Resource
win7-20230703-en
Behavioral task
behavioral23
Sample
manifest.json
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
ic_content_sticker_location.xml
Resource
win7-20230703-en
Behavioral task
behavioral25
Sample
ic_content_sticker_location.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
ic_content_sticker_location_60_percent_black.xml
Resource
win7-20230621-en
Behavioral task
behavioral27
Sample
ic_content_sticker_location_60_percent_black.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
ic_content_sticker_location_black.xml
Resource
win7-20230703-en
Behavioral task
behavioral29
Sample
ic_content_sticker_location_black.xml
Resource
win10v2004-20230621-en
Behavioral task
behavioral30
Sample
ic_content_sticker_location_emerald.xml
Resource
win7-20230703-en
Behavioral task
behavioral31
Sample
ic_content_sticker_location_emerald.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
l17846d7a_a32.so
Resource
debian9-armhf-20221111-en
General
-
Target
Norican.ttf
-
Size
45KB
-
MD5
3426ee499f815a2ea5a90b1ae7447bf3
-
SHA1
e74bdc08e742904dcc23e4af44978bcb74a5fa59
-
SHA256
f8f8988cf7cc2bfa4093c6aa2ff97e4b0e0f3e1e6f64750cc8a94426c646a951
-
SHA512
ca027a480f62a826ebf416c2b81f581fb17b19fc70fa3e33750fb03d29553fae513e78d742380578bbf201bf2f40a7555b58a5d0fdbfa565aa23601be945cb16
-
SSDEEP
768:Hdidy5DYCQipTTQuLRBGyKJnZBKA6osTCDjzDAW5b9k6gGzVfj5DazMMditIP0Pj:4dMlfQuLnGxPdsTCDj1puGTPIP0Pge
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings cmd.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4900 wrote to memory of 2024 4900 cmd.exe 86 PID 4900 wrote to memory of 2024 4900 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Norican.ttf1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\System32\fontview.exe"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Norican.ttf2⤵PID:2024
-