Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 00:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Haber5.com - Haber Alarmı.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Haber5.com - Haber Alarmı.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
Haber5.com - Haber Alarmı.exe
-
Size
686KB
-
MD5
26058209c0ffc1ff133c428405399d55
-
SHA1
df1e89357bfcdc44acddb82254889dec3aa0f237
-
SHA256
420dfdf6ff6c02a0dcbb23c65efd20e0dcf7b02f39aa90da38eed11a56ee9fd7
-
SHA512
7653a9385faf411f852c35ef63f8823fe95cd1c3364ec3817178386ed5d099128f58a5c5bef00a363c02bf198b66f77c84f94ec28583c6ac6c706232e204d9dc
-
SSDEEP
12288:vWv35JBQvz1+9Rm/JK9wAyf9i5XtAbG4HbQvHHlIo9ISoXWt82gw/D593g:vcJJx9RmxKbDvPldlyL2gw/H
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HaberAlarmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Haber5.com - Haber Alarmi.exe" Haber5.com - Haber Alarmı.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1372 Haber5.com - Haber Alarmı.exe 1372 Haber5.com - Haber Alarmı.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1372 Haber5.com - Haber Alarmı.exe 1372 Haber5.com - Haber Alarmı.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1372 Haber5.com - Haber Alarmı.exe 1372 Haber5.com - Haber Alarmı.exe