Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/08/2024, 21:12
Static task
static1
General
-
Target
observer (4)07.exe
-
Size
380KB
-
MD5
371e14f7e146ff22cb9ebe2f78cbfb7f
-
SHA1
2fde663b31a46e83f3034464674ad3f3a85f6972
-
SHA256
bb17d47f10fefcee4c883f93f2989e753b969298dd70262ae00696dd482dc9b4
-
SHA512
457cb7d4056200a4bcde4390d411e7f886e8b2fb00aef3d15d68b22c5d09bff74eeca9b241a6e69252a1e91acdaa97c23904ef8bbd5f6d6d3f852233a89c1eab
-
SSDEEP
3072:D7g6EFujqoyCdr5vWh6fPpyuvFU4F+fHRfAGdtq6mDBVz8gJeRvqol4c4QqVo+Po:Hg6EFYdNOhN5N63h8gCr4bQcPfIu3Rpm
Malware Config
Extracted
Family
observer
C2
http://5.42.66.25:3000
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4456 4380 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language observer (4)07.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\observer (4)07.exe"C:\Users\Admin\AppData\Local\Temp\observer (4)07.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 12162⤵
- Program crash
PID:4456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4380 -ip 43801⤵PID:1096