Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 12:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcc55ef512ccf37a07ec703b59cc7aad.exe
Resource
win7-20240708-en
4 signatures
150 seconds
General
-
Target
fcc55ef512ccf37a07ec703b59cc7aad.exe
-
Size
150KB
-
MD5
fcc55ef512ccf37a07ec703b59cc7aad
-
SHA1
9abef70ff67a2a7032ac1da4cd65424e7b2130b7
-
SHA256
38b26e2364bc081a90145838451341f14bda3cbd15bba54bf0114cab5d2f8667
-
SHA512
e26567479340c42126937edba18399af1d070b89c95fb8871dcbf3afb524bc89e289d361f4aa038f655e77b28e095ae3e487d8938248ea3d32677168acd17517
-
SSDEEP
3072:1QeAu96QNvQRARkML2zzFT1xfeRfAqq9a7JcKYfb5q9ZX4o3+mI:v9zvQvMLqFT1JZ9a7NYfbkT93fI
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2628 set thread context of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 set thread context of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 set thread context of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 set thread context of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fcc55ef512ccf37a07ec703b59cc7aad.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 wrote to memory of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 wrote to memory of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 wrote to memory of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 wrote to memory of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 wrote to memory of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 wrote to memory of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 wrote to memory of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 wrote to memory of 2124 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 31 PID 2628 wrote to memory of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 wrote to memory of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 wrote to memory of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 wrote to memory of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 wrote to memory of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 wrote to memory of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 wrote to memory of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 wrote to memory of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 wrote to memory of 2320 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 32 PID 2628 wrote to memory of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 wrote to memory of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 wrote to memory of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 wrote to memory of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 wrote to memory of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 wrote to memory of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 wrote to memory of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 wrote to memory of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 wrote to memory of 1216 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 33 PID 2628 wrote to memory of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34 PID 2628 wrote to memory of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34 PID 2628 wrote to memory of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34 PID 2628 wrote to memory of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34 PID 2628 wrote to memory of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34 PID 2628 wrote to memory of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34 PID 2628 wrote to memory of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34 PID 2628 wrote to memory of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34 PID 2628 wrote to memory of 3008 2628 fcc55ef512ccf37a07ec703b59cc7aad.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exe"C:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exeC:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exe2⤵PID:2124
-
-
C:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exeC:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exe2⤵PID:2320
-
-
C:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exeC:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exe2⤵PID:1216
-
-
C:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exeC:\Users\Admin\AppData\Local\Temp\fcc55ef512ccf37a07ec703b59cc7aad.exe2⤵PID:3008
-