Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/08/2024, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
612de30a28d8872ce9b107a0ec53c380N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
612de30a28d8872ce9b107a0ec53c380N.exe
Resource
win10v2004-20240802-en
General
-
Target
612de30a28d8872ce9b107a0ec53c380N.exe
-
Size
472KB
-
MD5
612de30a28d8872ce9b107a0ec53c380
-
SHA1
dfe5b27782198161d226e51eb4921217c7a29897
-
SHA256
a199b931dd05686c1405a773b08f81267e4f1faed240519be9c07143552ad7c1
-
SHA512
baef7099ee21feba439eea577a33288d6509a22baa073927ed801e796512e5e50a137340e709d1bacfedc3f4666b66d739aa382cb459c0d9a10c4c838790c7b0
-
SSDEEP
3072:sJj8RinudiP52xx67lLdLiHDoRJ/Jj/CwwsKpLiH1HxxrTkQxk2HHIU:sJAkgiPA6R9PRJ/Jj/GvpsHoU
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1796 2064 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 612de30a28d8872ce9b107a0ec53c380N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2064 wrote to memory of 1796 2064 612de30a28d8872ce9b107a0ec53c380N.exe 29 PID 2064 wrote to memory of 1796 2064 612de30a28d8872ce9b107a0ec53c380N.exe 29 PID 2064 wrote to memory of 1796 2064 612de30a28d8872ce9b107a0ec53c380N.exe 29 PID 2064 wrote to memory of 1796 2064 612de30a28d8872ce9b107a0ec53c380N.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\612de30a28d8872ce9b107a0ec53c380N.exe"C:\Users\Admin\AppData\Local\Temp\612de30a28d8872ce9b107a0ec53c380N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 362⤵
- Program crash
PID:1796
-