Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe
Resource
win10v2004-20240508-en
General
-
Target
761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe
-
Size
2.8MB
-
MD5
29f695e173146960935b718edf6cb54f
-
SHA1
00a4371e196b838dd42819270e3680f3ae6d737d
-
SHA256
761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff
-
SHA512
8e9213a7fbd1407b77c915bcd4b89cc1a0a581671b0364632e9eb967dee0a887f299bd3e3453e91eec0df23914a6ae1e0028ee6303f211ca9eaaf4f51ed97c83
-
SSDEEP
24576:3GFsa5BHN+/SQzHiszHj514yyv222/aJuyx29UB/AYU89E0QUE4chA6pgo+PeWbU:3GF95BHNSHiJJwwUKrzoLhWmR
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation rundll32.exe -
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2836 761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2836 wrote to memory of 2096 2836 761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe 28 PID 2836 wrote to memory of 2096 2836 761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe 28 PID 2836 wrote to memory of 2096 2836 761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe 28 PID 2836 wrote to memory of 2096 2836 761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe 28 PID 2836 wrote to memory of 2096 2836 761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe 28 PID 2836 wrote to memory of 2096 2836 761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe 28 PID 2836 wrote to memory of 2096 2836 761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe"C:\Users\Admin\AppData\Local\Temp\761e6c26583b419849d3160f9b0fa8bbc60b02251e0c5c325710befce6340cff.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL intl.cpl,,02⤵
- Checks computer location settings
- Modifies Control Panel
PID:2096
-