Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2024, 21:50
Static task
static1
Behavioral task
behavioral1
Sample
2ce9e38d1648e7715750e573c3891bd26fdbb1e981ec47b392451ab2ae0652fd.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2ce9e38d1648e7715750e573c3891bd26fdbb1e981ec47b392451ab2ae0652fd.exe
Resource
win10v2004-20240730-en
General
-
Target
2ce9e38d1648e7715750e573c3891bd26fdbb1e981ec47b392451ab2ae0652fd.exe
-
Size
4.8MB
-
MD5
1f71187127c4e3f6979102b8b9e736ce
-
SHA1
d77ce0db89096c6f3e1ad251be5f2eb51a99a4d3
-
SHA256
2ce9e38d1648e7715750e573c3891bd26fdbb1e981ec47b392451ab2ae0652fd
-
SHA512
1a0a810a29af21f9b4daaca7f9af3041b4e9a56ea55b16d87f2c944b4829bea9a3a50389b1cd9d96c20eb786eb1a26010233a335cf52bce9d81d6e09a7e3de92
-
SSDEEP
24576:SVO8YDhMq0dqlzeCMe53y0TgVOyhv+MQpsEzMPjrns/w0dkMbk3+NTqzH/Qknzfr:t8YDhMqbw3z0TqzfnxV
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3008 5048 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ce9e38d1648e7715750e573c3891bd26fdbb1e981ec47b392451ab2ae0652fd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ce9e38d1648e7715750e573c3891bd26fdbb1e981ec47b392451ab2ae0652fd.exe"C:\Users\Admin\AppData\Local\Temp\2ce9e38d1648e7715750e573c3891bd26fdbb1e981ec47b392451ab2ae0652fd.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 7482⤵
- Program crash
PID:3008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 50481⤵PID:568