Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 02:17
Static task
static1
Behavioral task
behavioral1
Sample
816b927fa17027e87113bfecc465fd2907cd89d2a2bf4d0e4cbb21e7511992af.exe
Resource
win7-20240729-en
General
-
Target
816b927fa17027e87113bfecc465fd2907cd89d2a2bf4d0e4cbb21e7511992af.exe
-
Size
3.1MB
-
MD5
45e4bb3edf330525540112da0b82931b
-
SHA1
b3cdb2b5d88e6c0f81869d475c777378588d3e3b
-
SHA256
816b927fa17027e87113bfecc465fd2907cd89d2a2bf4d0e4cbb21e7511992af
-
SHA512
65837863b7e0f6bb30b679bce6c3db20079ddbf2a17b5f13e18eebca9a17a16b4d64883bfe04e1b754675e2b45fb2409fc119f52b513e943b1eeae1c515d92e6
-
SSDEEP
49152:JNEyYYC1hqiJckG38dBFOhg5/6qF3rjb/h4CNcTCP8xphzSNtOSe+aS:nEP1y3+0hgh6u/ZcTCP8BzONaS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2364 setup.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 816b927fa17027e87113bfecc465fd2907cd89d2a2bf4d0e4cbb21e7511992af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\816b927fa17027e87113bfecc465fd2907cd89d2a2bf4d0e4cbb21e7511992af.exe"C:\Users\Admin\AppData\Local\Temp\816b927fa17027e87113bfecc465fd2907cd89d2a2bf4d0e4cbb21e7511992af.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\7zS85571477\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS85571477\setup.exe2⤵
- Executes dropped EXE
PID:2364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD5241331bede4cd250aeead156de3225c0
SHA14e6ebbfda62706203c7f3016d136560854841358
SHA256b476f1c8521db36255a862af284f462eef77c4fd5233adb002137af7835f5e86
SHA5129eb8f3970645315c73e80cea2af9364d8aa68d4e3383cdf21dd0393fc74857538639793e995a66b6bd58f086738981ffc364a06b23b129fab380d0e59532d712