Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/08/2024, 04:39
Behavioral task
behavioral1
Sample
faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe
Resource
win10v2004-20240802-en
General
-
Target
faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe
-
Size
417KB
-
MD5
009f53038230492d3d3eefd4c4f203b8
-
SHA1
2a149b46a50794d2144c4f296b2a9202bafe9eec
-
SHA256
faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15
-
SHA512
437ab61b9b9c58fa069f60971a35f785f35b33febe186ed058ce9d20109213b7b4d90e9f6df7d0d2f7f34b7f38fffb87c0a62b2efe6c2a71ce595e9c26475ba5
-
SSDEEP
3072:LmVW8iTX/3Rfl8Xq1+0cxxsWEL02fXcIp08Moe9DESZLwSqDX2:SM7jJljxYTHYZM1v0Sqa
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2556-3-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/files/0x0007000000016d92-6.dat upx behavioral1/memory/2556-34-0x0000000000400000-0x0000000000468000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\tiny little virgin showing off her cherry pussy.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\horny ass licking lesbians.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\couple babes getting off with well hung dude.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\crazy old man playing young teen.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\plump brunette using her finger.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\winxcfg.exe faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\illgal incest preteen porn cum.mpg.exe faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\warcraft 3 crack.exe faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\hot slut with a big dildo.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\Nokia Unloker (most models).exe faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\horny little blonde spreading pink.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\babes getting big cocks off with lips.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\slutty japanese babe giving blowjob.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\Britney spears nude.exe faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\luscious babe with serious ass and firm titts.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\babe locking lips around her man's rod in backyard.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\teen spreading in the kitchen.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\Napster Clone.exe faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\trio having hardcore fucking fun.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\little chicken shy about exposing sweet cunt.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\honie displaying raw pink ass.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\naturaly tan babe with gorgous body.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\Blonde and Japanese girl bukkake.mpg.exe faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\polish naturals with nice round titties.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\cute petite amateur girl spreading her snatch.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\wild ebony slut taking two cocks.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\chunky broad with a hairy well used ass.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\blonde on couch gettin tight anal fucking.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\fat grannies action.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\Hotmail Hacker.exe faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\babe with dick stuck between her ass cheeks.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\dedicated honie giving dude a helping hand and head.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe File created C:\Windows\SysWOW64\macromd\nasty chick in hardcore fucking.mpg.pif faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe"C:\Users\Admin\AppData\Local\Temp\faa7843c3c2bd0032195b7cf0cf0771465b2101de47dd1d8679a019fe26a5c15.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD589f298b46dd9dddfb25794f4c928981f
SHA1c7272e27b8c61ff2db09eb72fc82ba755363ab32
SHA25668e8048c809498c7a9002c5d13dae735bfb7680f6bc8092fdade61b6b391c714
SHA512a73f772c023676607fa605777ef5d9a34a48d0b326b2381f7e023710d5c56c28abfc3d1adb69e47b82b127f1a25ec6898c8f88f0812eeb11ff84068f5fca744e